Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD 6.2

openbsd.org

Post reply on HN
Print view View original

11–20 of 65 posts

Re: OpenBSD 6.2

#11

Post by bch »

eugeneionesco wrote: post #4
thatzerodude wrote: post #3

Earlier quoted context omitted.

I've used it on my laptop. Primarily because it has had few vulnerabilities and is very stable.

>I've used it on my laptop. Primarily because it has had few vulnerabilities and is very stable. The OpenBSD propaganda works I see... Do you really think the tools you use like your web browser, mail client etc, have less vulnerabilities on OpenBSD than on any other BSD or linux distribution, please...

> Do you really think the tools you use like your web browser, mail client etc, have less vulnerabilities on OpenBSD...

A reasonable question, but presumptuously and poorly framed, I think. Mitigation efforts like privilege separation[0] (for daemons), ASLR[1], SSP[2], and now KARL[3] are designed to make things systemically better. I'm personally a NetBSD person, and don't see that ending anytime soon, but I do appreciate the work that OpenBSD does and pay attention with interest. I expect some of their work to be ported to my environment directly, and other effects to be felt tangentially. People running different or "weird" environments is a good thing.

[0] https://en.wikipedia.org/wiki/Privilege_separation

[1] https://en.wikipedia.org/wiki/Address_space_layout_randomiza...

[2] http://wiki.osdev.org/Stack_Smashing_Protector

[3] http://undeadly.org/cgi?action=article&sid=20170613041706

Re: OpenBSD 6.2

#12

Post by notaplumber »

eugeneionesco wrote: post #4
thatzerodude wrote: post #3

Earlier quoted context omitted.

I've used it on my laptop. Primarily because it has had few vulnerabilities and is very stable.

>I've used it on my laptop. Primarily because it has had few vulnerabilities and is very stable. The OpenBSD propaganda works I see... Do you really think the tools you use like your web browser, mail client etc, have less vulnerabilities on OpenBSD than on any other BSD or linux distribution, please...

Yes, browsers are a large attack surface. But I'd take a quick peek at the recent Security improvements section on this release page, and also OpenBSD's innovations page.

https://www.openbsd.org/innovations.html

OpenBSD was the second OS to enable W^X JIT on its firefox package, W^X being made mandatory system-wide, and in Theo de Raadt's most recent conference talk he mentions chromium being pledged. Both browsers are compiled as PIE by default.

http://undeadly.org/cgi?action=article&sid=20151021191401

Re: OpenBSD 6.2

#13

Post by ams6110 »

christophilus wrote: post #2

Off topic a bit, but anyone here use OpenBSD? I'd be interested in hearing why you use it, and what your experience has been like.

I use it wherever I can. It's my main desktop system at work and at home. I like the simplicity and reasonably conservative rate of change.

Re: OpenBSD 6.2

#14

Post by saghm »

bch wrote: post #11
eugeneionesco wrote: post #4

Earlier quoted context omitted.

>I've used it on my laptop. Primarily because it has had few vulnerabilities and is very stable. The OpenBSD propaganda works I see... Do you really think the tools you use like your web browser, mail client etc, have less vulnerabilities on OpenBSD than on any other BSD or linux distribution, please...

> Do you really think the tools you use like your web browser, mail client etc, have less vulnerabilities on OpenBSD... A reasonable question, but presumptuously and poorly framed, I think. Mitigation efforts like privilege separation[0] (for daemons), ASLR[1], SSP[2], and now KARL[3] are designed to make things systemically better. I'm personally a NetBSD person, and don't see that ending anytime soon, but I do appr…

OT, but I've had trouble in the past when trying out NetBSD; I wanted to install it on my laptop with full disk encryption, but I clearly was missing something about how to do it properly, and I've never been able to find a good guide for it. Any chance you might know a blog post or something that details how to do this properly for a NetBSD newbie like me?

Re: OpenBSD 6.2

#15

Post by bch »

saghm wrote: post #14
bch wrote: post #11

Earlier quoted context omitted.

> Do you really think the tools you use like your web browser, mail client etc, have less vulnerabilities on OpenBSD... A reasonable question, but presumptuously and poorly framed, I think. Mitigation efforts like privilege separation[0] (for daemons), ASLR[1], SSP[2], and now KARL[3] are designed to make things systemically better. I'm personally a NetBSD person, and don't see that ending anytime soon, but I do appr…

OT, but I've had trouble in the past when trying out NetBSD; I wanted to install it on my laptop with full disk encryption, but I clearly was missing something about how to do it properly, and I've never been able to find a good guide for it. Any chance you might know a blog post or something that details how to do this properly for a NetBSD newbie like me?

I've run it in the past, but not recently. I'll see if something appears to me and try to post it here for you.

And good luck with your NetBSD journey, with or without FDE. I've thoroughly enjoyed my years with it as my primary OS.

Re: OpenBSD 6.2

#16

Post by Athas »

christophilus wrote: post #2

Off topic a bit, but anyone here use OpenBSD? I'd be interested in hearing why you use it, and what your experience has been like.

I use OpenBSD on my personal server. It does not do anything advanced, but runs email, a few websites, IRC bots, and such. I am not a professional systems administrator, nor do I consider myself a particularly competent one (I'm a compiler researcher). OpenBSD is the only system where I feel confident that what I have set up will be reasonably functional and secure. This is partly because OpenBSD comes with sane defaults and excellent documentation, but also because most software in the base system has fairly few features, and is focused on the common case, so I have less rope with which to hang myself. At the same time, it is so simple that I can actually understand in detail what's going on, and what the configuration files do.

Experienced systems administrators may have other reasons for preferring OpenBSD - I really wouldn't know. To me, OpenBSD certainly fills a niche for someone who is fundamentally knowledgeable about computers (and willing to read documentation and write configuration files), yet is not a full-time sysadmin.

Re: OpenBSD 6.2

#17

Post by tyfon »

christophilus wrote: post #2

Off topic a bit, but anyone here use OpenBSD? I'd be interested in hearing why you use it, and what your experience has been like.

I have OpenBSD on my firewall, a small old machine running irssi and an old laptop for fiddling.

My experience is that it's simple to use and well documented.

Re: OpenBSD 6.2

#18

Post by DrPhish »

christophilus wrote: post #2

Off topic a bit, but anyone here use OpenBSD? I'd be interested in hearing why you use it, and what your experience has been like.

I've been using it as my only firewall OS of choice since the 2.5 release in '99.

I have almost always used it as a firewall or networking appliance, and only rarely used it as a desktop OS, and never on my main machine.

It has evolved over the decades to be a swiss army knife of network functionality that rivals expensive appliances like the F5 in certain areas. Things like PF, CARP, rdomains, relayd, ifstated, openbgpd, ospfd, opensmtp, unbound, nsd and sane ipsec tools among others in the base system allow for some amazing possibilities. Config file syntax of the various tools has been converging on a nice, consistent, mostly self-documenting "standard" as well.

Constant auditing and refactoring has proactively fixed many holes before that were used in exploits on other platforms, and has brought a steady improvement in performance over the years.

As others have pointed out the entire system has a very consistent and well integrated feel. The documentation is very well maintained.

Support of devices with poor documentation or binary blobs has been slow to come, but does eventually tend to make it into the system. 802.11n on atheros is the example of something I personally had to wait a long time for.

Re: OpenBSD 6.2

#19

Post by keithpeter »

tyfon wrote: post #17
christophilus wrote: post #2

Off topic a bit, but anyone here use OpenBSD? I'd be interested in hearing why you use it, and what your experience has been like.

I have OpenBSD on my firewall, a small old machine running irssi and an old laptop for fiddling. My experience is that it's simple to use and well documented.

I'd concur with the simple to use and excellent documentation. I use OpenBSD on an old laptop, see...

http://sohcahtoa.org.uk/openbsd.html

...for details. And I'll be updating the page for 6.2 in a bit.

Re: OpenBSD 6.2

#20

Post by dbolgheroni »

terminalcommand wrote: post #6
christophilus wrote: post #2

Off topic a bit, but anyone here use OpenBSD? I'd be interested in hearing why you use it, and what your experience has been like.

I've used FreeBSD on my laptop (lenovo x201) for a long time, I've also installed OpenBSD from time to time. The rumors on the internet was that OpenBSD had better hardware support. I remember someone claiming that whereas FreeBSD developers use VMs to develop, OpenBSD devs used native machines (mostly laptops). I faintly remember that installing OpenBSD was harder than FreeBSD. FreeBSD came with a terminal graphical…

I don't get why people put so much emphasis on the boot time nowadays. I have a 5 years old laptop which takes less than 30 seconds to boot, with Xorg already.

Even if you power cycle every day. If you ACPI sleep (and it works great), you I'll have to boot your machine once every 6 months, when there is a new OpenBSD release.

I would much rather "spend 30 seconds" every 6 months to boot the OS I want to run for 12 hours/day than to "save some seconds" in months to run an OS that I don't for the same amount of time.

I'm not sure people realize how much complexity you have to add to make a system boot even a couple of seconds faster. If you somehow have to diagnose a problem in a system like this, all the seconds you saved in a lifetime will be spent on a single debugging session.

Post reply on HN