Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD 7.9

openbsd.org

Post reply on HN
Print view View original

171–180 of 314 posts

Re: OpenBSD 7.9

#171

Post by tptacek »

terry_hc wrote: post #168
tptacek wrote: post #124

Earlier quoted context omitted.

https://isopenbsdsecu.re/ (This site is extremely good and has fairly recent coverage, point-by-point, of all OpenBSD's mitigations. An important subtext to take to this is that OpenBSD has a reputation for introducing mitigations that exploit developers make fun of. Some of them are great, some of them less so.)

The slides are over 6 years old. The developers' attitudes haven't changed much, but are all of the arguments still valid? I've followed this discussion here and there over the years and it always goes like this: 1) everyone makes fun of the mitigations 2) many even outright assert they can easily defeat and exploit OpenBSD 3) nobody provides a working PoC when asked to demonstrate how insecure the OS is And somewher…

The site isn't the slide deck. Let's talk after you've read it?

Re: OpenBSD 7.9

#172

Post by infinet »

nelsonic wrote: post #11

With all the security issues constantly being uncovered in other Operating Systems - which will only accelerate with Ai - it’s time everyone considers OpenBSD. Their decades-long security-focus is second to none. We have fully converted from Ubuntu/Debian to OpenBSD. No looking back.

I tried OpenBSD recently and found it behaves very differently from other OS. The same code works on Linux/FreeBSD/Windows but has poor multi thread performance on OpenBSD, async socket stopped working after sending at high speed for few seconds. I am not saying there is anything wrong in OpenBSD, it is just different.

Re: OpenBSD 7.9

#173

Post by binkHN »

upofadown wrote: post #159

The big news for some of us is that Exim has been dropped from ports. Here is a good article about transitioning from Exim to OpenSMTPD: https://nxdomain.no/~peter/time_for_opensmtpd.html I tried using OpenSMTPD a long time ago, shortly after it came out, but things were not stable enough. I guess it is time to give it another go...

I really like OpenSMTPD; no nonsense and configuration feels rather modern compared to the legacy stuff that's out there.

Re: OpenBSD 7.9

#174

Post by 866-RON-0-FEZ »

rs_rs_rs_rs_rs wrote: post #141
866-RON-0-FEZ wrote: post #83

Earlier quoted context omitted.

Your arrogance is continued proof you could never comprehend the work that goes into building, releasing, and maintaining an entire OS, and your contributions will forever be limited to snarky negativity on message boards.

Anything on unveil and not about me?

If you think their code sucks to the point people should think twice about using it, I suggest you stop using OpenSSH immediately.

Please be sure to let us know when your better, more secure replacement is ready.

Re: OpenBSD 7.9

#175

Post by mghackerlady »

brynet wrote: post #170
mghackerlady wrote: post #111

Earlier quoted context omitted.

OpenBSD supports sparc very well and is compatible with old sunos stuff (iirc). Unfortunately no 68k anymore (okay, technically there's a niche flavour of 68k that still is supported because of a very dedicated man in Japan)

> OpenBSD supports sparc very well and is compatible with old sunos stuff (iirc) No 32-bit sparc anymore (only UltraSPARC, aka sparc64). No SunOS compatibility (despite Theo de Raadt inventing it for NetBSD, before being copied by other BSDs). https://marc.info/?l=openbsd-tech&m=161435521906992&w=2 > Technically there's a niche flavour of 68k that still is supported because of a very dedicated man in Japan luna88k, w…

I must've read about the sunos thing somewhere and imagined it still existed.

>luna88k, while related, is not 68k

I misremembered it as being similar to the relationship between the 6502 and the 65C816

Re: OpenBSD 7.9

#176

Post by bigyabai »

nelsonic wrote: post #40
ska80 wrote: post #25

I wish OpenBSD supported Bluetooth. Unfortunately, its absence is a deal breaker for me. I did use OpenBSD on the desktop it was great.

Interesting! Curious which Bluetooth device(s) you can’t live without.

Naming a few peripherals on my desk that see regular usage on Linux:

- Kensington Expert Trackball (I lost the 2.4ghz dongle)

- JBL wireless earbuds/Audio Technica M40xs

- Nintendo Switch controller

Re: OpenBSD 7.9

#177

Post by blackhaz »

Sorry for the off-topic, but I wish our FreeBSD camp could roll back a little from this faux-corporate glass ball without soul and a font from the early 90s spaceship toy box, to Beastie and a stylish serif. What I was trying to say - I'm in envy. OpenBSD artwork is absolutely amazing!

Re: OpenBSD 7.9

#178

Post by ori_b »

3form wrote: post #150
yjftsjthsd-h wrote: post #100

Earlier quoted context omitted.

If you need root to set up the escape , then yes that is relatively uninteresting. Like, we know chroot can't contain root.

Thanks. It was not evident from the example whether root inside of the sandbox is necessary - I assumed creating arbitrary symlinks doesn't require any particular capabilities, and there's nothing special about the locations. Though it's not clear to me now: - why was this patched then? - is the point about root that non-root wouldn't have access to passwd anyway?

OpenBSD doesn't have separate user accounts for sandboxes. These sandboxes are not linux-style containers, they're narrowed views of the full install.

If you're root inside the sandbox, you're root outside it. This exploit requires you to already be root.

Re: OpenBSD 7.9

#179

Post by cccbbbaaa »

nelsonic wrote: post #133
maxall4 wrote: post #90

Earlier quoted context omitted.

Is OpenBSD actually more secure than Linux? I have not been able to find any data to support this—only some vague opinions.

The Data: Compare the number of CVE vulnerability trends over time between Linux: https://www.cvedetails.com/vendor/33 and OpenBSD: https://www.cvedetails.com/vendor/97 It's not even close! It's nearly two orders of magnitude higher for Linux. This isn't anecdotal or “vague opinion” CVEs are facts. You can ask the follow-up question: Why is that? And there are many reasons. It could just be that Linux having more use…

Going by CVEs, Haiku is more secure than OpenBSD. Linux has had strong kernel-level crypto enabled by default on major distributions for years, see AF_ALG or LUKS.

On the wiki page you provided, the only thing that really stands out at the kernel level is KARL, which has a dubious utility: https://isopenbsdsecu.re/mitigations/karl/ It is not even up to date: strlcpy(3) and strlcat(3) were implemented in glibc 3 years ago.

Re: OpenBSD 7.9

#180

Post by miah_ »

reidrac wrote: post #160
nelsonic wrote: post #35

Earlier quoted context omitted.

How long did what take? Learning the essentials of OpenBSD, budget 4-6hours. Switching over servers from Ubuntu, an hour for the first one then 10mins each after that. You can copy config with your favourite tools; most have ports for OpenBSD already. If you want to learn more in-depth, read: Michael W. Lucas Absolute OpenBSD, 2nd Edition: Unix for the Practical Paranoid. Highly recommend it as teaches many fundament…

How many upgrades have you done so far? And how many kernel fixes? Long time ago I maintained a couple of obsd servers, and the cost in time of upgrades and the (occasional) security fixes was substantial. I still maintain a couple of servers, but if it wasn't because Debian makes it easier by automating most of it, I don't think I could do it. Yet I miss my time with obsd. I'm very interested in your experience. Edi…

syspatch and sysupgrade have made things substantially easier these days.
Post reply on HN