Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD Passes 300,000 Commits

undeadly.org

Post reply on HN
Print view View original

21–30 of 40 posts

Re: OpenBSD Passes 300,000 Commits

#21

Post by splaff »

jmhain wrote: post #12
wyager wrote: post #2

For those who have heard of OpenBSD but have not used it, I strongly recommend trying it on your next server appliance. I have been using it on my servers for some time now and I have been very happy. The entire OS seems to be of substantially higher quality than Linux.

> The entire OS seems to be of substantially higher quality than Linux. That's a pretty bold statement. Care to elaborate?

As a long time lurker, I'm going to jump on this one.

Yes it is bold by the user but I agree entirely.

I spent the best part of a decade running Solaris and Linux machines from 1998-2008. The Solaris kit was easy to keep running once you'd got over the initial configuration hell and was very stable. The Linux stuff however was nasty at best. From CIFS/SMB crashes taking out the VFS layer to drivers packing in to incorrect documentation to random hangups. That is across CentOS and Debian. They are not even remotely stable IMHO. Debian is far better than CentOS was but that still pales in comparison to even, dare I say it, Windows Server 2008.

As a sideline, I'd been using OpenBSD on a couple of test machines because it was interesting and I encountered entirely the opposite of the above. I threw it into production instead of a CentOS 5 box that we were retiring as a postfix/dovecot SMTP/IMAP box. The throughput is about 10-15%[1] less but my word the thing is a million times easier to administer and is absolutely bomb proof. Every configuration option, tool etc is entirely and perfectly documented. It is nothing but bliss. It just keeps ticking. We now have 3 hosts on it. The only missing bit is a decent OpenJDK port but the software guys are starting to use Python for a lot of stuff so that may be moot shortly anyway.

My metric for an operating system's reliability is if it goes wrong, how much crap do I have to deal with? Well I'm confident that if an OpenBSD host went down that I could have it back up, even if the internet connection was out and all I had was an OpenBSD CD. I can't say the same about anything else these days. Last time I lose an md raid on Linux, it took me a day to get it back due to nothing but crappy documentation and bugs even those it was a tested recovery strategy.

[1] The thing is a hefty HP Xeon box so this is background noise compared to the actual load.

Re: OpenBSD Passes 300,000 Commits

#22

Post by splaff »

keithpeter wrote: post #18
adamrt wrote: post #15

Earlier quoted context omitted.

Its actually very easy to upgrade OpenBSD. There is lots of information on that page and you should read it all, but the actual process of the upgrade is quick.

Following -current and updating within a release Would you recommend the patch by patch process or the full check out code and compile?

Success recipe I use:

1. Install a release.

2. Subscribe to the security list.

3. Patch any issues that turn up and may affect you using the instructions in the patch. Rarely this requires a reboot. Don't patch anything you don't need to.

4. Upgrade release a couple of weeks after it is released (everyone else has found the bugs then ;-)

5. To manage ports, subscribe to the ports mailing list, create packages yourself from ports on another machine and install them and upgrade them yourself if there is an upgrade or security hole posted.

Before you do anything though, test it on another host properly. YMMV with all updates on all platforms.

Re: OpenBSD Passes 300,000 Commits

#23

Post by Nux »

splaff wrote: post #20
Nux wrote: post #19

Earlier quoted context omitted.

I appreciate the OS, but I wish it had a longer lifetime, as it is I can't really set it up on servers in a serious manner. It might be good on firewalls though where they don't expose a lot of services to the internet.

That's not really a major concern if you've used it at all. Their lifecycle is security oriented and you only get reliable security coverage if you keep something up to date. There's no point in sitting around living off backports and patches forever as all that does is create work. It's pretty easy to upgrade as well. With respect to application services, they can evolve independently to the base OS as well.

I've toyed with it, not sure if that qualifies as "used". As a DC sysadmin I live off backports and patches (CentOS). 99% of our deployed OSes are all supported a long (to very long) time.

Re: OpenBSD Passes 300,000 Commits

#24

Post by splaff »

Nux wrote: post #23
splaff wrote: post #20

Earlier quoted context omitted.

That's not really a major concern if you've used it at all. Their lifecycle is security oriented and you only get reliable security coverage if you keep something up to date. There's no point in sitting around living off backports and patches forever as all that does is create work. It's pretty easy to upgrade as well. With respect to application services, they can evolve independently to the base OS as well.

I've toyed with it, not sure if that qualifies as "used". As a DC sysadmin I live off backports and patches (CentOS). 99% of our deployed OSes are all supported a long (to very long) time.

I used to do that but having had certain duff kernels and SMB packages out of RH, they can go to hell.

This one took out our SMB/CIFS implementation in CentOS 6.2 forcing us to grab some windows licenses in the end (which I will add has been damn reliable):

https://bugzilla.redhat.com/show_bug.cgi?id=476442

Still broken in CentOS 6.5 and Centos 7.0. Many people have raised this issue (google it) and it's always "fixed next release".

Patched and built my own kernel in the end but by then it was too late.

No thanks. Had enough of crap like that.

Re: OpenBSD Passes 300,000 Commits

#25

Post by truncate »

farresito wrote: post #17

Might be slightly off-topic, but how would you compare it to DragonflyBSD? I've been thinking on trying out the main BSD.

Their focus is different from what I can see. OpenBSD is about rock solid security. DFBSD original aim was to implement single system image (maybe it still is). In past few years, I see most visible work on HAMMER filesystem which you shThey released some benchmarks outperforms FreeBSD and NetBSD considerably on multi-core systems.[1]

If you write kernel code, you may like, vkernel, which is full blown kernel that runs on userspace. Speeds up kernel development process.

[1] http://www.dragonflybsd.org/performance/

Re: OpenBSD Passes 300,000 Commits

#27

Post by 4ad »

Animats wrote: post #8

It's amusing that commit 300,000 fixes a buffer overflow. It's a demonstration that large C programs do not converge to the state of having no buffer overflows.

OpenBSD is not one program though. It's a collection of many programs, large and small, some independent, mostly not.

Re: OpenBSD Passes 300,000 Commits

#28

Post by Nux »

splaff wrote: post #24
Nux wrote: post #23

Earlier quoted context omitted.

I've toyed with it, not sure if that qualifies as "used". As a DC sysadmin I live off backports and patches (CentOS). 99% of our deployed OSes are all supported a long (to very long) time.

I used to do that but having had certain duff kernels and SMB packages out of RH, they can go to hell. This one took out our SMB/CIFS implementation in CentOS 6.2 forcing us to grab some windows licenses in the end (which I will add has been damn reliable): https://bugzilla.redhat.com/show_bug.cgi?id=476442 Still broken in CentOS 6.5 and Centos 7.0. Many people have raised this issue (google it) and it's always "fixe…

Well, I won't turn this into a thread to fix that problem, but have you tried these packages? http://enterprisesamba.com/

Having said that, switching to OpenBSD is not as simple. It's not just some random web server with 2 sites on it; we're talking many, many servers with a great range of software running on them and so on. Some of this software will not even run on OpenBSD at all and so on. The problems are many. :)

The big linux distros - buggy as they are - are here to stay.

Also, some interesting "statistics" from $dayjob. Our DC workload (dedicated servers) is mostly web stuff; when I joined the company in 2009 there were a reasonable amount of FreeBSD servers around; that number is now 0 (or very close); my opinion is that it went "extinct" because of poor binary updates and package management as well as lack of long term support. CPanel stopping to support it was probably the last nail in the coffin. I'm seeing a similar thing with Debian, Ubuntu LTS took over that customer base.

OpenBSD - from our pov - is facing the same issues. I'd love to see more BSDs deployed, but this will not happen unless the above points are addressed. Add to that the lack of "kickstart"-like functionality, as well.

Re: OpenBSD Passes 300,000 Commits

#29

Post by kamechan »

yellow_and_gray wrote: post #26

Am I the only one who suspects a high number of commits is a sign of good programming, and by induction good programmers?

high number of commits can be one indicator of "goodness"

but consider an unsolvable problem that tempts developers, yet stumps them at the same time. they could all commit a solution thinking it's the right one, yet nobody actually solves a problem.

not saying this about BSD ... obviously, but: high number of commits is not a very good metric besides indicating that people are committing.

Re: OpenBSD Passes 300,000 Commits

#30

Post by farresito »

truncate wrote: post #25
farresito wrote: post #17

Might be slightly off-topic, but how would you compare it to DragonflyBSD? I've been thinking on trying out the main BSD.

Their focus is different from what I can see. OpenBSD is about rock solid security. DFBSD original aim was to implement single system image (maybe it still is). In past few years, I see most visible work on HAMMER filesystem which you shThey released some benchmarks outperforms FreeBSD and NetBSD considerably on multi-core systems.[1] If you write kernel code, you may like, vkernel, which is full blown kernel that ru…

Thank you for your answer. Yes, OpenBSD is definitely about security. I'm also aware of the performance benchmarks. Pretty interesting. The thing is I'm still not completely sure which niche it fills (and I'm pretty sure it fills one). I guess I will have to give them a long try myself and see if I can come with a conclusion.
Post reply on HN