Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why use OpenBSD?

tumfatig.net

Post reply on HN
Print view View original

61–70 of 106 posts

Re: Why use OpenBSD?

#61

Post by Cockbrand »

PunchyHamster wrote: post #20
brobdingnagians wrote: post #3

Servers I setup in openbsd just keep working, and are an easy patch/upgrade process. Servers I setup in Ubuntu break and have weird patching issues. Maybe it's something I'm doing, but I sure do like that OpenBSD seems a lot easier to just have solid and work indefinitely.

You are not....it's Ubuntu. Not Linux, not Debian, Ubuntu. Debian (provided you don't just dump a bunch of 3rd party repos) just upgrades cleanly, we have hundreds of servers that just run unattended-upgrade and get upgraded to new Debian version every 2 years. The few Ubuntus we had had more problems.

I used to have this Debian box (which was a PowerMac G4) in my hallway. It had a 1000+ day uptime, back when this kind of uptime was still cool, or at least I thought it was. At some point it was two major versions behind, and I decided to dist-upgrade it. To my amazement, the upgrade went flawlessly, and the system booted without problems afterward. Debian is just great like that.

Re: Why use OpenBSD?

#62

Post by SoftTalker »

throwaway270925 wrote: post #53
matt-p wrote: post #31

I adore openbsd and have been using it since 4.x however it is still slow, not slow to boot or anything like that but if you run it as a web server it manages about half the req/s of Debian. Network performance is also slower than Debian if you're using it as a firewall (but I still prefer it as the syntax of PF is just perfect).

It's gotten a lot faster with 7.6 (lots of work on the TCP stack iirc). We saw huge improvements in throughput after updating. The new 7.8 release should bring some more performance, haven't tested it yet though.

Yes, they've been working on unlocking more and more performance over the 7.x series of releases if not longer.

Remember the BSDs date from an era when you only had one core in the CPU.

Re: Why use OpenBSD?

#63

Post by SoftTalker »

mono442 wrote: post #12

To be honest I don't really see a reason to use a *BSD system myself other than just for the sake of using something different and less mainstream. FreeBSD had some advantages in the past but nowadays Linux has caught up in features.

To me the advantages are: simpler and more consistent configuration, less churn, better documentation, focus on security and secure-by-default.

Yes if raw performance is your top priority, linux wins. But for a desktop or general-purpose server, that's not the most important thing for me.

Re: Why use OpenBSD?

#64

Post by hylaride »

dilippkumar wrote: post #56

Long time OpenBSD fan. Used it as my daily driver for years before standardizing all computers at home to macOS. I still think about going back to openBSD one day, but it's no longer very practical as a daily driver. I want to use OpenBSD for the next project I'm building. However, I can't wrap my head around the old way of doing deployments (before containers). People who've built production grade systems with OpenB…

> Long time OpenBSD fan. Used it as my daily driver for years before standardizing all computers at home to macOS. I still think about going back to openBSD one day, but it's no longer very practical as a daily driver.

It's only practical for hobbyists. I used OpenBSD as a daily driver between 2001-2005. I fought, I suffered, I conquered, and I got tired of not being able to watch video on the web reliably and MacOS in those days was so clean and refreshing. I learned so much, though.

> I want to use OpenBSD for the next project I'm building.

I admire your open-mindedness. But ask yourself:

1. Do you want to have to upgrade fleets of servers every year with no exceptions for extended security support instead of 5 (or more if you're willing to pay) for LTS versions of Linux?

2. Who else will need to support it?

3. You will likely have worse performance if that matters.

> 1. How do you deploy software?

Honestly, not many people create their own services that run on OpenBSD. Those that do use old-school packaging and scripting. Tooling like ansible works.

> 2. How do you manage fleets of servers?

Ansible would be my go-to for classic fleets of servers.

> How do you spin up/turn down servers from cloud providers?

There are ports of cloud-init for OpenBSD. Creating images for third party OSes can be different levels of painful, depending on the cloud provider.

Re: Why use OpenBSD?

#65

Post by hulitu »

thomashabets2 wrote: post #30
hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

Finally Linux has something that approaches pledge/unveil: landlock. Seccomp was never actually usable: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...

Linux is far too bloated to ve run as a secure system and the attack surface of any linux distro, due to the number of kernel modules loaded by default, is very big.

Re: Why use OpenBSD?

#66

Post by SoftTalker »

dilippkumar wrote: post #56

Long time OpenBSD fan. Used it as my daily driver for years before standardizing all computers at home to macOS. I still think about going back to openBSD one day, but it's no longer very practical as a daily driver. I want to use OpenBSD for the next project I'm building. However, I can't wrap my head around the old way of doing deployments (before containers). People who've built production grade systems with OpenB…

OpenBSD has virtualization out of the box now. Most of the benefit of containers you can get with chroot. I don't know if any of the developers are working on a true container/jail capability.

I'd like to see a more modern performant filesystem with OpenBSD but ffs has never really let me down. Capability for logical volumes and/or live resizing of partitions would be welcome as well.

Re: Why use OpenBSD?

#67

Post by dokyun »

loloquwowndueo wrote: post #16
shevy-java wrote: post #6

Earlier quoted context omitted.

Well - I would recommend using a better linux distribution than Ubuntu. I run just lighttpd these days; used to run httpd before they decided the configuration must become even more complicated. I don't have any issues with lighttpd (admittedly only few people use it; most seem to now use nginx).

And which distribution would that be?

Slackware

Re: Why use OpenBSD?

#69

Post by unethical_ban »

jorvi wrote: post #46
hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

> I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. That really depends. You could argue a router is a server. OpenWRT has the default of WiFi off for security, which means that if the config is somehow hosed and you have to hard reset the router, you now have an inaccessible brick unless you happen to have a…

You bring up a particular edge case as a way to discredit a much more thorough essay on the system.

And if someone is administering routers but don't have the hard-line equipment to configure them locally, I wish them well.

Re: Why use OpenBSD?

#70

Post by indigodaddy »

dilippkumar wrote: post #56

Long time OpenBSD fan. Used it as my daily driver for years before standardizing all computers at home to macOS. I still think about going back to openBSD one day, but it's no longer very practical as a daily driver. I want to use OpenBSD for the next project I'm building. However, I can't wrap my head around the old way of doing deployments (before containers). People who've built production grade systems with OpenB…

RE: 1/2, doesn't Ansible work for BSDs?
Post reply on HN