Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why use OpenBSD?

tumfatig.net

Post reply on HN
Print view View original

71–80 of 106 posts

Re: Why use OpenBSD?

#71

Post by DoctorOW »

jorvi wrote: post #46
hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

> I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. That really depends. You could argue a router is a server. OpenWRT has the default of WiFi off for security, which means that if the config is somehow hosed and you have to hard reset the router, you now have an inaccessible brick unless you happen to have a…

> Edit: it's so funny to know that all the people slamming the downvote have never hit the brick wall of a dumb default.

I'll bite. OpenBSD and OpenWRT are different things, and I'm honestly surprised to hear that tech matters enough to you to setup OpenWRT but not enough to own a desktop (or a laptop that doesn't skimp on ports)

Re: Why use OpenBSD?

#72

Post by SoftTalker »

idoubtit wrote: post #48
Guestmodinfo wrote: post #38

Earlier quoted context omitted.

How to upgrade Debian unattended if it's not a rolling release

Not the Grand Poster, but we use the Debian package "unattended-upgrades" to install security updates automatically on our servers, and send an email if a reboot is required to complete the process (kernel upgrade). Unattended upgrades could be configured to install more than the security release. Even with the stable release, one can add the official APT source for the Debian backports.

Back to OpenBSD... realize that it has no "unattended upgrades" capability. Until syspatch(8) appeared in 6.x you had to download patches and rebuild kernel and userland to get security fixes. Today, you could run syspatch(8) in a cron job but that only covers the base system. You'd need to handle any installed packages separately. And only the current and immediately previous release are supported at all. There are two releases a year, so you have to upgrade every ~6 months to stay in the support window.

Fortunately, with the introduction of the syspatch(8) and sysupgrade(8) utilities this is much simpler than it used to be. And, release numbers are just sequential with one point number, i.e. 7.0 was just the next release after 6.9, nothing more is implied by the "major" number ticking up.

Re: Why use OpenBSD?

#73

Post by thelastgallon »

dijit wrote: post #52
matt-p wrote: post #31

I adore openbsd and have been using it since 4.x however it is still slow, not slow to boot or anything like that but if you run it as a web server it manages about half the req/s of Debian. Network performance is also slower than Debian if you're using it as a firewall (but I still prefer it as the syntax of PF is just perfect).

there's a lot of optimisations they don't engage with because it makes the code "ugly" but there's a larger one here, where they disable hyperthreading outright due to side-channel attacks. Might be a leading cause of what you're seeing.

So, spin up lots of single-core VMs?

Re: Why use OpenBSD?

#74

Post by sedawkgrep »

hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

> The firewall on OpenBSD is miles better to configure than iptables.

That's understating the matter by a huge amount.

pf is easier to read and understand, easier to adjust, more dynamic, and works like every other firewall in the world not based on iptables.

Re: Why use OpenBSD?

#75

Post by dijit »

thelastgallon wrote: post #73
dijit wrote: post #52

Earlier quoted context omitted.

there's a lot of optimisations they don't engage with because it makes the code "ugly" but there's a larger one here, where they disable hyperthreading outright due to side-channel attacks. Might be a leading cause of what you're seeing.

So, spin up lots of single-core VMs?

for I/O intensive applications, it's always been true that VMs are a decent chunk of overhead: https://sites.cc.gatech.edu/systems/projects/Elba/pub/JackLi...

Also, it's likely already in a VM.

Re: Why use OpenBSD?

#76

Post by graemep »

PunchyHamster wrote: post #28
mono442 wrote: post #12

To be honest I don't really see a reason to use a *BSD system myself other than just for the sake of using something different and less mainstream. FreeBSD had some advantages in the past but nowadays Linux has caught up in features.

BSD license so you don't have to upstream your stuff would be one. Tho it's not an advantage to *BSD systems, Linux near-forcing vendors to go mainline (as keeping separate kernel tree is PITA) did a lot of good in hardware support.

Not really a problem for users. Only for people who want to redistribute a fork. It matters if you are Apple or Sony, but not for most people.

incidentally, the requirement of the GPL is not to upstream your stuff, but to offer to make the modified source available to anyone you distribute the code to. Often the same in practice, but does not have to be.

Re: Why use OpenBSD?

#77

Post by cyberpunk »

hylaride wrote: post #60
Guestmodinfo wrote: post #41

Earlier quoted context omitted.

Just a few hours ago on the irc channel of OpenBSD someone said that OpenBSD is good at not letting a wonky hardware run compared to linux. So you could use the dmesg and ask it in the OpenBSD mailing list and they will point out which wonky hardware is causing trouble and you can replace that problematic part. I ran OpenBSD current for 6 years and never faced such issue

Years ago (circa ~2005) I was working for a company with a mix of OpenBSD, FreeBSD, Windows, and Linux. I was more of a fan of OpenBSD and I received a lot of grief when the OpenBSD team suddenly ripped out support for one of the Dell hardware RAID controllers (I don't remember which one, but IIRC it was one based on something from Adaptec), claiming they couldn't reliably reverse engineer it to create stable drivers…

Hangon on a second, you paid dell support and they knowingly let you run production on kit with known total irreversible data loss bugs? Da. Fuq?!?

Re: Why use OpenBSD?

#79

Post by hylaride »

cyberpunk wrote: post #77
hylaride wrote: post #60

Earlier quoted context omitted.

Years ago (circa ~2005) I was working for a company with a mix of OpenBSD, FreeBSD, Windows, and Linux. I was more of a fan of OpenBSD and I received a lot of grief when the OpenBSD team suddenly ripped out support for one of the Dell hardware RAID controllers (I don't remember which one, but IIRC it was one based on something from Adaptec), claiming they couldn't reliably reverse engineer it to create stable drivers…

Hangon on a second, you paid dell support and they knowingly let you run production on kit with known total irreversible data loss bugs? Da. Fuq?!?

To be fair, there was not much Dell could do as their PERC cards were all rebranded Adaptec and later LSI. Adaptec was the gold standard for ages, but I assume was enshitified somewhere along the way. The long term result was that the entire hardware raid world ditched Adaptec for LSI and/or software RAID (eg ZFS). Dell (in those days, not sure if it's still the case) had excellent support. There was a bug on another server model where the onboard video card would eventually fail and fry the motherboard. Even years later out of support, Dell would for free replace it if it failed with whatever new model equivalent existed.

I left the company before things were totally resolved, but I think dell ultimately gave people who complained LSI cards, but it took awhile for those to be designed and manufactured to fit the internal drive slot. Most people who were also using external arrays moved to third party ones or other hardware.

Some background from an OpenBSD dev:

https://nickh.org/warstories/adaptec.html

Re: Why use OpenBSD?

#80

Post by jorvi »

DoctorOW wrote: post #71
jorvi wrote: post #46

Earlier quoted context omitted.

> I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. That really depends. You could argue a router is a server. OpenWRT has the default of WiFi off for security, which means that if the config is somehow hosed and you have to hard reset the router, you now have an inaccessible brick unless you happen to have a…

> Edit: it's so funny to know that all the people slamming the downvote have never hit the brick wall of a dumb default. I'll bite. OpenBSD and OpenWRT are different things, and I'm honestly surprised to hear that tech matters enough to you to setup OpenWRT but not enough to own a desktop (or a laptop that doesn't skimp on ports)

They are, but Linux or BSD doesn't matter all that much when it is about the meta case of deciding the defaults.

Funnily enough I feel a BSD is much more suited to modems / routers, if it weren't for HW WiFi support. Yes, I know you can separate your routing and your access point onto different devices.

At any rate I'm just pointing out that that absolutionism is rarely the right answer. It's also pretty telling that people actually went through my comment history to downvote a few unrelated recent comments. People get angry when they have to adjust their assumptions.

As far as computing device goed, I prefer not lugging around a plastic brick. And one is bound to either lose or forget a dongle. In which case you get boned by OpenWRT's dumb default.

The reason for that default is that if they set up an open OpenWRT WiFi (or default passworded, think "OpenWRT2025"), in that split 5 minute window before you change it, some wardriver might login and mess with your network.

Obviously the chances of that are rather insignificant. And they could generate a default password based on the hardware. For the real security nuts they could tell them to build an image without default-on WiFi (currently they do the inverse).

Post reply on HN