Why use OpenBSD?

Post by tasn » Sun, Nov 16, 2025, 8:08 PM UTC

sedawkgrep wrote: post #74

hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

> The firewall on OpenBSD is miles better to configure than iptables. That's understating the matter by a huge amount. pf is easier to read and understand, easier to adjust, more dynamic, and works like every other firewall in the world not based on iptables.

Post by detourdog » Sun, Nov 16, 2025, 8:34 PM UTC

idoubtit wrote: post #82

detourdog wrote: post #2

The list is missing the fact that the documentation is consistent and centralized.

The post has many links to OpenBSD's man pages, FAQ and manual. But I thought it was quite unsatisfying, even common tasks are missing. Or at least I couldn't find them. I had a test case in mind while reading the documentation: running a custom web service with Nginx as a reverse-proxy. In the documentation, I couldn't find anything about creating a service. Are we supposed to write a frontend script (in ksh) that a…

Post by basscomm » Sun, Nov 16, 2025, 9:42 PM UTC

dijit wrote: post #52

matt-p wrote: post #31

I adore openbsd and have been using it since 4.x however it is still slow, not slow to boot or anything like that but if you run it as a web server it manages about half the req/s of Debian. Network performance is also slower than Debian if you're using it as a firewall (but I still prefer it as the syntax of PF is just perfect).

there's a lot of optimisations they don't engage with because it makes the code "ugly" but there's a larger one here, where they disable hyperthreading outright due to side-channel attacks. Might be a leading cause of what you're seeing.

Post by itopaloglu83 » Sun, Nov 16, 2025, 11:34 PM UTC

idoubtit wrote: post #48

Guestmodinfo wrote: post #38

Earlier quoted context omitted.

How to upgrade Debian unattended if it's not a rolling release

Not the Grand Poster, but we use the Debian package "unattended-upgrades" to install security updates automatically on our servers, and send an email if a reboot is required to complete the process (kernel upgrade). Unattended upgrades could be configured to install more than the security release. Even with the stable release, one can add the official APT source for the Debian backports.

Post by pabs3 » Sun, Nov 16, 2025, 11:58 PM UTC

itopaloglu83 wrote: post #87

idoubtit wrote: post #48

Earlier quoted context omitted.

Not the Grand Poster, but we use the Debian package "unattended-upgrades" to install security updates automatically on our servers, and send an email if a reboot is required to complete the process (kernel upgrade). Unattended upgrades could be configured to install more than the security release. Even with the stable release, one can add the official APT source for the Debian backports.

Just curious, how do you manage service restarts, just restart as the update finishes? I think I’m a bit scarred when a docker upgrade took my entire stack down because of an api mismatch with portainer, so I’m trying to be present during upgrades. Edit: I’m talking about Debian of course. I’m not familiar with OpenBSD.