Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why use OpenBSD?

tumfatig.net

Post reply on HN
Print view View original

91–100 of 106 posts

Re: Why use OpenBSD?

#91

Post by pabs3 »

scatbot wrote: post #10

One of the reasons why I'm using OpenBSD is because it passes what I think of as a litmus test for FLOSS software: can I build the whole thing from scratch, in a short time and with minimal fuss? In the case of OpenBSD, the answer is yes. I can install it on a new machine, fetch the source code from mirrors, do some edits to the source, build a fresh release, write it to a USB stick and boot it on another machine. On…

Does OpenBSD have Bootstrappable Builds from source without any binaries? I'm guessing not yet, since GNU Guix (Linux distro) pioneered that, and I haven't seen any BSD distro interested in the related Reproducible Builds project.

https://bootstrappable.org/ https://reproducible-builds.org/

Re: Why use OpenBSD?

#92

Post by JCattheATM »

I feel like people user it either due to fixation/hobby reasons, or because they've heard it's secure and good for routers so they just use it as a router, assuming the rumors are true.

Honestly myself, I prefer NetBSD approaches to many things, or for Linux Alpine, which is perfectly small, minimal and secure by default.

Re: Why use OpenBSD?

#93

Post by f30e3dfed1c9 »

mono442 wrote: post #12

To be honest I don't really see a reason to use a *BSD system myself other than just for the sake of using something different and less mainstream. FreeBSD had some advantages in the past but nowadays Linux has caught up in features.

> To be honest I don't really see a reason to use a *BSD system myself

I use FreeBSD+ZFS for storage servers. I definitely want to use ZFS for these and I don't think Linux+ZFS is as good a combination.

It depends on what you want to do. If you want a typical laptop with a desktop environment, then FreeBSD might not be a good choice. Horses for courses.

Re: Why use OpenBSD?

#95

Post by 7bit »

jorvi wrote: post #46
hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

> I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. That really depends. You could argue a router is a server. OpenWRT has the default of WiFi off for security, which means that if the config is somehow hosed and you have to hard reset the router, you now have an inaccessible brick unless you happen to have a…

You are being downvoted for comparing OpenBSD to OpenWRT. They are about as different than a foundation to a house.

Re: Why use OpenBSD?

#96

Post by miladyincontrol »

hulitu wrote: post #65
thomashabets2 wrote: post #30

Earlier quoted context omitted.

Finally Linux has something that approaches pledge/unveil: landlock. Seccomp was never actually usable: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...

Linux is far too bloated to ve run as a secure system and the attack surface of any linux distro, due to the number of kernel modules loaded by default, is very big.

And yet, countless companies do just fine.

Re: Why use OpenBSD?

#97

Post by pjmlp »

thomashabets2 wrote: post #30
hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

Finally Linux has something that approaches pledge/unveil: landlock. Seccomp was never actually usable: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...

Seccomp is heavily used on Android.

Re: Why use OpenBSD?

#98

Post by nolist_policy »

thomashabets2 wrote: post #30
hellcow wrote: post #25

I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. Pledge and unveil worked brilliantly to restrict our Go processes to specific syscall sets and files. The firewall on OpenBSD is miles better to configure than iptables. I never had challenges upgrading them--they just kept working for years.

Finally Linux has something that approaches pledge/unveil: landlock. Seccomp was never actually usable: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...

Chrome and Firefox use seccomp for sandboxing since more that 15 years: https://lwn.net/Articles/346902/

Re: Why use OpenBSD?

#99

Post by jorvi »

7bit wrote: post #95
jorvi wrote: post #46

Earlier quoted context omitted.

> I built my last company on OpenBSD. It was easy to understand the entire system, and secure-by-default (everything disabled) is the right posture for servers. That really depends. You could argue a router is a server. OpenWRT has the default of WiFi off for security, which means that if the config is somehow hosed and you have to hard reset the router, you now have an inaccessible brick unless you happen to have a…

You are being downvoted for comparing OpenBSD to OpenWRT. They are about as different than a foundation to a house.

I'm not comparing those, I'm comparing absolutionist vs. flexible attitude.

People are downvoting because I'm making them realize they have to rethink their assumptions, and it is less painful to attack the messenger rather than actually do so. People these days are generally bad at not tying their identity to things and not taking it personal.

Re: Why use OpenBSD?

#100

Post by thomashabets2 »

shiomiru wrote: post #42
thomashabets2 wrote: post #30

Earlier quoted context omitted.

Finally Linux has something that approaches pledge/unveil: landlock. Seccomp was never actually usable: https://blog.habets.se/2022/03/seccomp-unsafe-at-any-speed.h...

> Seccomp was never actually usable It's barely usable by itself but I don't think it's an inherent problem of seccomp-bpf, rather the lack of libc support. Surely the task of "determine which syscalls are used for feature X" belongs in the software that decides which syscalls to use for feature X. In fact, Cosmopolitan libc implements pledge on Linux on top of seccomp-bpf: https://justine.lol/pledge/

Well, kinda.

The "what does the equivalent of pledge(stdio) actually mean?" doesn't have to actually be on the kernel side. But it's complicated by the fact that on Linux, syscalls can be made from anywhere. On OpenBSD syscalls are now only allowed from libc code.

So even if one uses Cosmopolitan libc, if you link to some other library that library may also do direct syscalls. And which syscalls is does, and under which circumstances, is generally not part of the ABI promise. So this can still break between semver patch version upgrades.

Like if a library used to just not write debug logs by default, but then changed so that they are written, but to /dev/null, then there's no way to inform application code for that library, much less update it.

If you ONLY link to libc, then what you said will work. But if you link to anything else (including using LD_PRELOAD), then all bets are off. And at the very least you'll also be linking to libseccomp. :-)

If libc were the only library in existence, then I'd agree with your 100%.

Post reply on HN