Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU study recommends OpenBSD

undeadly.org

Post reply on HN
Print view View original

131–140 of 153 posts

Re: EU study recommends OpenBSD

#131

Post by yellowapple »

dijit wrote: post #121
yellowapple wrote: post #109

Earlier quoted context omitted.

At least with packages, there are "no-X" versions of most packages available (useful if you don't have X on a machine).

the problem isn't that it's dependant for X11 on packages.. moreso that the port system requires X11 to function.. http://comments.gmane.org/gmane.os.openbsd.ports/54692 http://www.openbsd.org/faq/faq15.html#NoFun (at the bottom of this section)

Ah, I see.

My point about packages still stands, though; I don't use ports on my OpenBSD servers (since it's much easier on server load to just download/install a package than to try to build things from source; well, that and the lack of a need to install a whole lot on an OpenBSD server besides a runtime for $SERVER_PROGRAMMING_LANGUAGE, but whatever). I suppose if you're particularly paranoid about downloading things from the internet, you could build packages on your personal workstation with the necessary env vars to disable X11 support in the package, then move those packages over to the server and install them there (basically, doing what OpenBSD's ports/packages maintainers already do in order to create the packages in the first place, but on your own).

Re: EU study recommends OpenBSD

#132

Post by csirac2 »

dijit wrote: post #49

I love openBSD, it's implementation of certain things is slower (like networking), but it's so clean and well implemented. even if it doesnt' get to play with all the toys (like ZFS) it's what I'd love to default to for application servers/bastion server/firewalls etc; my only qualm with it currently is it's reliance of X11 for ports to work- I don't like install X11 libs on my servers wherever I can avoid it. :\

To be fair I have this problem on Debian too. Sometimes there is foo-nox, the foo version without X dependencies, but I seem to find myself building such packages for myself to omit some afterthought GUI bit which drags in Qt, gtk, or half of the gnome universe for no reason.

Re: EU study recommends OpenBSD

#133

Post by nbevans »

yellowapple wrote: post #110
th0waway wrote: post #33

Earlier quoted context omitted.

Yep, the issue was fixed (even though it took a while).

And by "a while", one means "a few days after discovery" (a few months after it was introduced , but that's actually not terrible, all things considered).

Fact check: It was introduced years priors to discovery, not mere months.

Re: EU study recommends OpenBSD

#134

Post by nbevans »

higherpurpose wrote: post #54
nbevans wrote: post #29

"[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts." That worked great for OpenSSL didn't it? ;)

Microsoft has had 2 Heartbleed-level vulnerabilities in its Windows code so far, that were not just 2-3 years old but 10+ years old, leaving systems vulnerable to them for much longer. The "advantage" of proprietary code here was that Microsoft got to downplay them (surprise surprise, no scary logo made by Microsoft for them!), and that's how proprietary code owners deal with security issues in general - they try to…

What on earth is HN sheep's obsessions with making logos for security bugs? This seems to be a very new phenomenon that the young upstarts expect to see when a big bug is found?

This has nothing to do with Microsoft. It is about a false assertion (i.e. OSS peer review leading to less bugs) made so fleetingly that the authors clearly expected it to be accepted by readers as a proven fact. It isn't proven. And I gave just one of countless examples why OSS peer review has proven itself to not necessarily work as one might naively expect it to.

Re: EU study recommends OpenBSD

#135

Post by toyg »

dash2 wrote: post #58

For those that know more about OpenBSD than the EU (and I salute you for it), the EU parliament is a fairly powerless institution. Eurocrats show it little respect; one described it as "just one big fucking NGO". Update after reading it: this isn't even an official parliament document or recommendation. It's something by the parliament's research service.

> the EU parliament is a fairly powerless institution.

Nope. The EU Parliament (elected), the Commission (periodically nominated by national governments) and the Council (meeting of national governments) are the three "heads" of the EU political system, and they are locked in a constant struggle to determine the exact boundaries of their powers. The Parliament is the youngest institution, hence the historical disregard of entrenched interests; at the same time, it's the institution most hungry for power, because it's the only one with a clear democratic mandate.

As others mentioned, software patents were a battlefield for such struggle: the Commission repeatedly recommended their introduction (IIRC, at the behest of a certain Microsoft-friendly Irish commissioner), and the Parliament repeatedly sent them packing. You will find several other instances of this happening: the democratic mandate of the EU Parliament in most cases will eventually trump backroom agreements in the Commission, as long as the topic becomes mainstream enough to invoke such mandate.

In future, the institution that is destined to become more and more powerless is one between the Council and the Commission, since their scope overlaps now that the Parliament has taken over the "legislative" process earlier left to the Commission.

Re: EU study recommends OpenBSD

#136

Post by lawnchair_larry »

nostrademons wrote: post #128
trengrj wrote: post #127

Earlier quoted context omitted.

The above comment isn't attacking "teams with great software security people" but the fact that in proprietary software people can and do downplay vulnerabilities (not a very controversial statement). I've noticed tptacek over the past few years that your comments have shifted from great general security advice to more defending "the security profession". Please consider this shift and whether it is helpful.

Is your assessment that "in proprietary software people can and do downplay vulnerabilities" based on looking at HN/news stories, or based on directly interacting with security teams at those companies? In my experience, the worst security offenders are either small businesses or big businesses whose core competency is not in tech. My friend managed to download 50,000 passwords from GreatestJournal.com because they l…

Google is the exception. Most major closed source vendors, even those known for their security, hide vulns that were not externally reported.

Re: EU study recommends OpenBSD

#137

Post by lawnchair_larry »

tptacek wrote: post #122
higherpurpose wrote: post #54

Earlier quoted context omitted.

Microsoft has had 2 Heartbleed-level vulnerabilities in its Windows code so far, that were not just 2-3 years old but 10+ years old, leaving systems vulnerable to them for much longer. The "advantage" of proprietary code here was that Microsoft got to downplay them (surprise surprise, no scary logo made by Microsoft for them!), and that's how proprietary code owners deal with security issues in general - they try to…

This is the second time today you've spread innuendo about how software security teams at big companies handle vulnerabilities, and the second time you've managed to casually insult teams that include some of the best software security people in the entire industry. Here's the first: https://news.ycombinator.com/item?id=9445436 These are egregiously bad arguments you're making, involving people who you don't know but…

He is actually more or less correct in the case of both Microsoft and Apple.

Re: EU study recommends OpenBSD

#138

Post by rakoo »

carussell wrote: post #115
rakoo wrote: post #55

Earlier quoted context omitted.

That's not the point. Let me rephrase that: - one of GPL's cool thing is that it prevents proprietary software from including GPL'd code without contributing back to the community - Because BSD is not as strict as GPL regarding license derivation, GPL says "BSD is bad, you're allowing proprietary software to use BSD code without giving back" - Some people take BSD code, modify it and distribute modifications under GP…

> exactly what GPL was against in the first place (preventing authors from enjoying modifications) This is not an accurate description of what the GPL is shooting for, which has significant consequences on the things built up from this misunderstanding.

You're right, it is important to remind that GPL is shooting for user freedom, and final users getting free access to modifications; that authors enjoy modifications is only a nice side-effect that isn't even required at all, but is in practice common. The misunderstanding seems to be from the clear separation between users and developers that GPL does.

Re: EU study recommends OpenBSD

#139

Post by higherpurpose »

tptacek wrote: post #122
higherpurpose wrote: post #54

Earlier quoted context omitted.

Microsoft has had 2 Heartbleed-level vulnerabilities in its Windows code so far, that were not just 2-3 years old but 10+ years old, leaving systems vulnerable to them for much longer. The "advantage" of proprietary code here was that Microsoft got to downplay them (surprise surprise, no scary logo made by Microsoft for them!), and that's how proprietary code owners deal with security issues in general - they try to…

This is the second time today you've spread innuendo about how software security teams at big companies handle vulnerabilities, and the second time you've managed to casually insult teams that include some of the best software security people in the entire industry. Here's the first: https://news.ycombinator.com/item?id=9445436 These are egregiously bad arguments you're making, involving people who you don't know but…

Are you contesting the fact that Microsoft downplayed some of its major remote code execution vulnerabilities or that Microsoft has been sharing zero-days with the NSA for years (and now Apple is doing the exact same thing - voluntarily)? I can come back with sources, but I think you know exactly what I'm referring to.

Maybe I painted with a too wide brush the "proprietary software teams pretending the vulnerabilities don't exist", but the "security through obscurity" expression didn't just come out of nowhere. Many proprietary software companies do try to hide or downplay their security holes when they happen - you can't seriously tell me you you're contesting that?

Re: EU study recommends OpenBSD

#140

Post by tptacek »

lawnchair_larry wrote: post #137
tptacek wrote: post #122

Earlier quoted context omitted.

This is the second time today you've spread innuendo about how software security teams at big companies handle vulnerabilities, and the second time you've managed to casually insult teams that include some of the best software security people in the entire industry. Here's the first: https://news.ycombinator.com/item?id=9445436 These are egregiously bad arguments you're making, involving people who you don't know but…

He is actually more or less correct in the case of both Microsoft and Apple.

You know that's not true.
Post reply on HN