Why OpenBSD Is Important to Me • Hacker News Board

Re: Why OpenBSD Is Important to Me

#131

Post by 4ad » Tue, May 10, 2016, 8:26 AM UTC

executesorder66 wrote: post #2

I'm curious why the author says Linux is "insecure, anti-secure, and anti-privacy software" Can anyone explain this? Also, why OpenBSD specifically, and not FreeBSD for example?

FreeBSD lacks (or disables) most mitigations OpenBSD (and usually Windows, or some Linux distros) have, like ASLR, stack protector, W^X, PIE applications by default, libc.so symbol randomization, pledge()'d ports, etc.

I love FreeBSD, and use it a lot, and I wish these were all implemented, but until then, it pains me that FreeBSD has less mitigations enabled than Windows and good Linux distros.

Re: Why OpenBSD Is Important to Me

#132

Post by oarsinsync » Tue, May 10, 2016, 8:28 AM UTC

blacksmith_tb wrote: post #93

oarsinsync wrote: post #27

Earlier quoted context omitted.

Can you elaborate on what the alternatives are? The more we all know, the better!

I suppose it depends on if we're talking about server-focused OSes or desktops - for the desktop, there's Qubes[1] and I think it would be fair to say ChromeOS[2] should be mentioned... 1: https://www.qubes-os.org/ 2: https://en.wikipedia.org/wiki/Chrome_OS#Security

Oh wow Qubes looks like a very interesting approach. I will be (somewhat hilariously) throwing that into a VM to try soon!

Re: Why OpenBSD Is Important to Me

#133

Post by 4ad » Tue, May 10, 2016, 8:38 AM UTC

OneTwoFree wrote: post #125

> Plenty of hardware in my life has backdoors (I'm looking at you Intel[1]) That same libreboot article[1] says that AMD is not any better. Is there any alternative I'm not aware of? An ARM Chromebook is unfortunately not fast enough for me. [1] https://libreboot.org/faq/#intel

I hope this will be good: https://www.raptorengineering.com/TALOS/prerelease.php

Re: Why OpenBSD Is Important to Me

#134

Post by ben_bai » Tue, May 10, 2016, 8:51 AM UTC

arjun1296 wrote: post #127

Does OpenBSD have good SMP support yet?

Be more specific with your question or give an example where it is too slow.

In general: In userland yes, in kernel yes and no and working on whatever seems too slow.

Re: Why OpenBSD Is Important to Me

#135

Post by ben_bai » Tue, May 10, 2016, 8:59 AM UTC

Qwertious wrote: post #115

nickysielicki wrote: post #107

Earlier quoted context omitted.

You don't have to be a sysadmin to think it's a bad idea for pid 1 to have a hard dependency on glibc . It's a nightmare. And it's incredibly ironic that the solution seems to be that you should migrate to operating systems where the userland and kernel are coupled together. And that's the crux of the argument against systemd. Is clean service management more important than portability? Of course not! Linux has alway…

"Linux has always been interesting because it's portable, not because it's easy or streamlined or standardized." Pretty sure Tanenbaum would disagree. That said, I do agree that portability really is important. For that matter, I'd really like a decent FOSS microkernel.

Since you mentioned Tanenbaum. What about Minix 3, It's basically a new/modern Microkernel with the NetBSD userland.

Re: Why OpenBSD Is Important to Me

#136

Post by PhantomGremlin » Tue, May 10, 2016, 9:07 AM UTC

aortega wrote: post #122

PhantomGremlin wrote: post #104

Earlier quoted context omitted.

I was not responding to "the mainstream OS OpenBSD ...". Let's go back to your remark, which preceded his: kernel exploits for OpenBSD are neither theoretical nor impractical. You put that out there as a bare, standalone statement. No elaboration, no proof. Your comment might be true, but I would have liked to see some more "meat" in it. Some supporting evidence, some inkling of a truly wonderful proof.

I did write a remote kernel exploit for OpenBSD, it was not an easy task, and this was in a time when there were basically no exploit countermeasures in kernel (2007) ( https://www.coresecurity.com/content/open-bsd-advisorie ) There are a bunch of local kernel exploits, all very practical and reliable. Kernel protections are something OpenBSD lacked until very recently.

Yes, thanks for reminding me of that one.

That timeline isn't pretty. The OpenBSD guys really needed to be dragged, kicking and screaming, to calling it a "security fix" rather than something milder like a "reliability fix".

Re: Why OpenBSD Is Important to Me

#137

Post by 4ad » Tue, May 10, 2016, 9:10 AM UTC

niroze wrote: post #85

Great opinion piece. I think this is mostly the opinion of anyone that really discovers OpenBSD and gets caught up in it. Security does matter, and the developers accept nothing less than what they want. My main problem with OpenBSD development is that all development is decided solely by the developers and there doesn't seem to be much care for what others want.. which is fine, they're doing all the work for peanuts…

I've seen this type of comments many times, in many different context, about many different open source software projects, and I never understood them.

> all (OpenBSD) development is decided solely by the developers and there doesn't seem to be much care for what others want

This implies this is not the case for every other project.

To pick on your SMP performance example, Linux doesn't have better SMP because "developer saw that people want SMP, and decided to implement it". Linux has better SMP because some people came and implemented it. Not at other's people request, that is never relevant.

Different open source projects attract different (developer) audiences, and different project have different audience sizes, but don't make the fallacy that some projects chose what to work on (architecturally speaking) because user demanded it. That is never the case. Everything big happens because developers want it.

Re: Why OpenBSD Is Important to Me

#138

Post by SkyMarshal » Tue, May 10, 2016, 9:19 AM UTC

nickpsecurity wrote: post #62

ktRolster wrote: post #53

Earlier quoted context omitted.

Here it is (not available): http://openports.se/emulators/wine I don't think FreeBSD is much more secure (if any) than some of the better GNU/Linux distributions though I do, and I've look through the source code of both. Edit: too early in the morning. I misread FreeBSD as OpenBSD in that sentence

It's really the focus. FreeBSD operates a little closer to the cathedral model where they're pickier, more deliberate, and more consistent. Linux takes in about anything to maximize features and development pace. Probably the reason FreeBSD has higher quality in code. Just different priorities. Of course, I watch these communities from a distance. I'm not in the trenches over there. So, I could be way off. :)

That seems to have always been the case, all the way back to the Torvalds vs Tannenbaum debates.

Re: Why OpenBSD Is Important to Me

#139

Post by Wildgoose » Tue, May 10, 2016, 9:21 AM UTC

dijit wrote: post #18

zxcvcxz wrote: post #15

I don't know how anyone can lump Linux in with Windows when it comes to security from NSA spying and then say OpenBSD is a good alternative. HN seems to love the anti-Linux FUD though. Anything that further fractures the OSS community is upvoted fast. I like the BSDs too, but there are a ton of reasons Linux is the most popular kernel in the world, it's not just because the NSA makes it so.

it's not just that though, there's the push for systemd which was not welcomed and alienated a lot of sysadmin folk who frequent hackernews. personally I felt rather shafted by systemd, not because it's bad, but because my arguments were never even met, it was just a brushing off from some of the people who had already accepted it. So I tried the BSD's and they were significantly better than I imagined they would be,…

Not just sysadmin folk. I'm a long time Linux user (since 1993) who has just switched his main machine to Gentoo in order to avoid systemd and has just installed OpenBSD on an old laptop to try it out.

Re: Why OpenBSD Is Important to Me

#140

Post by digi_owl » Tue, May 10, 2016, 10:34 AM UTC

vox_mollis wrote: post #20

dijit wrote: post #18

Earlier quoted context omitted.

it's not just that though, there's the push for systemd which was not welcomed and alienated a lot of sysadmin folk who frequent hackernews. personally I felt rather shafted by systemd, not because it's bad, but because my arguments were never even met, it was just a brushing off from some of the people who had already accepted it. So I tried the BSD's and they were significantly better than I imagined they would be,…

Indeed. If systemd were just a parallelized init system with better unit management, far more would be okay with this shift. But that wasn't enough. They had to hijack bootloading, logging, device management, network, etc. For reasons that nobody seems to be able to actually explicate.

Best i can tell, is a "developers developers developers" thing. The goal is to present a set of APIs that abstract away the underlying OS.

Sadly though this has been done multiple times over, but then discarded because of CADT.

Pop over to Freedesktop.org and you will find the remains of a number of discarded projects. Most of them discarded just as they are 99% feature complete and the devs face the prospect of doing janitorial maintenance.