Slashdot Mirror

yea, ok, but which HOWTO are you going to suggest to get the wired network going? how about setting up iptables? what if that distro doesn't support the wireless card? which HOWTO to install that driver?

i don't buy this "OpenBSD is hard" thing people claim. it is incredibly easy to install, and, unless you can't read or are incredibly dense, even easier to configure. anything man pages (yes, it has man pages, and they are far superior to any man page any linux distro has) miss are summed up in an excellent faq

We use Startup Monitor and ZoneAlarm Security Suite software firewall. The newest ZA pops up a window the first time anything suspicious happens. It's a big problem convincing users to report the ZA popups, but if they do, Windows is much safer.

However, it's a losing battle. The problem is that Microsoft makes more money if its operating systems self-destruct. What you call "vulnerabilities" billionaires call "maximizing shareholder value".

If rich people sold good operating systems, poor people would not buy the next upgrade.

Using an operating system is like having a partner in your business. If it is a Microsoft OS, your "partners" want some things that are bad for you. If you use Linux or BSD, you can breathe a huge sigh of relief; your partners want what you want.

It's absurd that governments of countries use Microsoft products. It's even absurd that state governments in the U.S. use Microsoft products. The U.S. federal government spends more money on world-wide surveillance than any country in the history of the world. Exploiting computer systems is now one of the biggest new frontiers in surveillance.

The U.S. government's Echelon surveillance system watches everyone all the time. (Echelon quote: "Since the close of World War II, the US intelligence agencies have developed a consistent record of trampling the rights and liberties of the American people.")

The biggest discretionary expense of the U.S. government is the cost of war. The president and the vice-president of the U.S. are people who themselves and their families and friends made their money through oil and weapons. Is it any wonder that the price of oil is so high and we have war?

When a country uses Microsoft operating systems, it effectively has the U.S. government as one of its partners. Given the present climate of corruption and conflict of interest and adversarial behavior and using war as a justification for anything, why do countries want the U.S. government and U.S. billionaires as partners?

If volunteers can make a secure operating system ("Only one remote hole in the default install, in more than 8 years!") is it difficult to believe that the amazing number of vulnerabilities we've seen in Windows are deliberately allowed?

That's because you're hanging out with the wrong kind of geeks.

You have to hang out with the guys that geek out on getting laid.

Why do embedded developers continue to imprison themselves in the GPL trap by using Linux, when there are better available alternatives that provide more freedom for developers?

As an OpenBSD user I can tell you that it does not have the broadest support. Let me back this counterclaim up.

OpenBSD supports the following chipsets (as taken from the OpenBSD i386 hardware compatibility page on 19th November 2005:

ADMtek, Aironet, Atheros, Atmel, Centrino (2100, 2200), Prism 2.5/3, Ralink (2500), Raytheon and Realtek

Now by comparison a Linux distro (e.g. Ubuntu) can have support for the following chipsets (list taken from Linux WLAN Howto cross referenced against Ubuntu) on 19th November 2005:

ADMtek, Aironet, Atheros, Atmel, Centrino (2100, 2200), Prism 2.5/3, Ralink (2400, 2500), Prism GT, Raytheon, Texas Instruments ACX100/110, Wavelan

A pretty similar list wouldn't you say (OpenBSD has Realtek which Ubuntu doesn't, Ubuntu has Ralink 2400, Prism GT, ACX100/110 and Wavelan which OpenBSD doesn't)? In fact, Linux has Realtek drivers too but as they aren't shipped in Ubuntu I left them off the list. Linux also has ndiswrapper and Linuxant Driverloader allowing the use of Win32 drivers but I'm discounting non native drivers.

Chipsets that aren't supported by either OS that are significant:
Broadcom - There's a heck of a lot of Broadcom stuff out there and no sign of open drivers ever. That's their perogative but this stuff is all over the place...
Marvel - a new 802.11g player as far as I can tell. No open source drivers that I know of so far.

For the meantime, chipsets like Broadcom mean that open source OSes will always have a more troublesome than Windows with random wireless drivers. Choose carefully and don't reward vendors with non free drivers where possible.

OpenVPN has had several VERY STUPID security problems discovered recently. Why not just keep using ipsec, but don't buy a shitty broken implimentation from cisco? http://www.openbsd.org/

Heh, it's one of the reasons I migrated from SuSE to *BSD after using it for a couple of years. OpenBSD package system has undergone alot development and is working very well. Here is some slides from a presentation of OpenBSD Ports and Packages.

For dog's sake, people _still_ think software installation is a nightmare on Linux, even people who have used it, and it hasn't been true for ages...on Debian. But Debian isn't that hyped now, is it? And it doesn't get glowing reviews, because of the text-mode installer and the fact that you don't get a neatly polished GUI straight out of the box.

Yup, eye-candy seems to matter more than functionality and correctness. To make matters worse, the "reviewers" focus on eye-candy sort of punishes those distros that put a lot of effort on infrastructure (like, for instance, a working package management system with packages that actually works).

When you can use an OS that starts out secure?

But your point is well taken; no operating system is immune to attack.

I would guess OpenBSD is pretty much immune to this type of attack, as long as the OS is not borrowing binaries from other OSes, but instead compiling it with propolice stack protection, and all the other nifties in 3.8. It will still crash of course, given that the bug remains in the package, but it will be near impossible to exploit it.

I would love to see an easy install/upgrade path for OpenBSD. As it is now, there's too much politics and too little hand-holding for me to accept it. I can probably figure it out, but time is an issue, and others can't reasonably take over when the bar is so high compared to Ubuntu / Debian.

What is surprising to me is how little Linux people value security. You would think the necessary means would be put in place, but only fringe distros like Adamantix really do it.

Performance on OpenBSD is important but it's not the primary focus. If someone put an OpenBSD mail server in place knowing performance was going to be critical, then they chose the wrong system. If they chose it with security as the most important criteria then the move to FreeBSD will mean that this area isn't as strong as it was with the old system.

We all want the best tool for the job but the poster seems to imply that in moving from OpenBSD to FreeBSD there's a win in the performance arena without any loss elsewhere. OpenBSD focusses on security. On top of the system-wide security features, the in-tree OpenBSD sendmail instance has lots of OBSD specific patches (http://www.openbsd.org/security.html). For example, when OpenBSD chose their MP implementation, they deliberately chose biglock because of it's (relative) simplicity. This is important because the OpenBSD codebase is actively audited. The fine grained locking in the FreeBSD MP implementation is obviously going to blow OpenBSD away but at the cost of simplicity (bugs and security issues are harder to find in complex code).

I wonder if there are any plans to incorporate the security features that OpenBSD has been introducing.

I wonder if there are any plans to incorporate the security features that OpenBSD has been introducing.

Singularity is a research project in Microsoft Research that started with the question: what would a software platform look like if it was designed from scratch with the primary goal of dependability? Singularity is working to answer this question by building on advances in programming languages and tools to develop a new system architecture and operating system (named Singularity), with the aim of producing a more robust and dependable software platform. Singularity demonstrates the practicality of new technologies and architectural decisions, which should lead to the construction of more robust and dependable systems.

Where have I hear that before?.

A key aspect of singularity is ... Software-Isolated Processes, which encapsulate pieces of an application ... and provide information hiding, failure isolation, and strong interfaces. All code outside the kernel executes in a SIP.

That sounds alarmingly like a closed address space. Microsoft in 2005 is giving us what UNIX had over 30 years ago. thx u sir!

SIPs are closed object spaces, not address spaces

I stand corrected! What's the difference?

Two Singularity processes cannot simultaneously access an object.

Ruh ruh! So we're going back to the model where two processes can't open a handle to the same file? You mean ... like .. er... DOS?

A process cannot dynamically open or generate code.

So like ... you can't run Perl on it. Or shared libraries. #include <dlfnc.h> is a thing of the past.

SIPs are created and terminated by the operating system, so that ... resources can be reclaimed.

Yeah uhhh... the runlib library for, say, C executables in UNIX does this. And has for a long time. Like, since Gerald Ford or something.

I'd go on but I'm just making fun of them. If you read through their overview document there's actually some very good ideas in there, and knowing a few programmers from W2K, I can tell you that they do employ some top-notch talent there.

Patching and support for OpenBSD installs isnt a process thats discouraging, or even time consuming. For the 6 month window during which OpenBSD 3.7 was the most recent stable release, there were just 5 patches released! Errata list for OpenBSD 3.7.
 
Only one of these was a kernel patch, so even if you are patching the system religiously ( as all security-aware admins should be ), only one reboot was needed in 6 months. Which wouldnt even cause an outage if you are using OpenBSD + CARP + pfsync. Enterprise-grade features in a free OS!

Patching and support for OpenBSD installs isnt a process thats discouraging, or even time consuming. For the 6 month window during which OpenBSD 3.7 was the most recent stable release, there were just 5 patches released! Errata list for OpenBSD 3.7.
 
Only one of these was a kernel patch, so even if you are patching the system religiously ( as all security-aware admins should be ), only one reboot was needed in 6 months. Which wouldnt even cause an outage if you are using OpenBSD + CARP + pfsync. Enterprise-grade features in a free OS!

It's clearly wrong! This one is much better.

Yes it does, go look at the port.

Even if the CDs aren't free to ship, they still have ultra-sexy CD covers styled around different themes. http://www.openbsd.org/images/openbsd38_cover.gif this release is INDY JONES! what is the audio track? wow bsd sounds so fun. http://www.openbsd.org/images/openbsd37_cover.gif yellow brick road http://www.openbsd.org/images/openbsd36_cover.gif western http://www.openbsd.org/images/openbsd35_cover.gif http://www.openbsd.org/images/openbsd32_cover.gif goldeneye!

Even if the CDs aren't free to ship, they still have ultra-sexy CD covers styled around different themes. http://www.openbsd.org/images/openbsd38_cover.gif this release is INDY JONES! what is the audio track? wow bsd sounds so fun. http://www.openbsd.org/images/openbsd37_cover.gif yellow brick road http://www.openbsd.org/images/openbsd36_cover.gif western http://www.openbsd.org/images/openbsd35_cover.gif http://www.openbsd.org/images/openbsd32_cover.gif goldeneye!

Even if the CDs aren't free to ship, they still have ultra-sexy CD covers styled around different themes. http://www.openbsd.org/images/openbsd38_cover.gif this release is INDY JONES! what is the audio track? wow bsd sounds so fun. http://www.openbsd.org/images/openbsd37_cover.gif yellow brick road http://www.openbsd.org/images/openbsd36_cover.gif western http://www.openbsd.org/images/openbsd35_cover.gif http://www.openbsd.org/images/openbsd32_cover.gif goldeneye!

Even if the CDs aren't free to ship, they still have ultra-sexy CD covers styled around different themes. http://www.openbsd.org/images/openbsd38_cover.gif this release is INDY JONES! what is the audio track? wow bsd sounds so fun. http://www.openbsd.org/images/openbsd37_cover.gif yellow brick road http://www.openbsd.org/images/openbsd36_cover.gif western http://www.openbsd.org/images/openbsd35_cover.gif http://www.openbsd.org/images/openbsd32_cover.gif goldeneye!

Even if the CDs aren't free to ship, they still have ultra-sexy CD covers styled around different themes. http://www.openbsd.org/images/openbsd38_cover.gif this release is INDY JONES! what is the audio track? wow bsd sounds so fun. http://www.openbsd.org/images/openbsd37_cover.gif yellow brick road http://www.openbsd.org/images/openbsd36_cover.gif western http://www.openbsd.org/images/openbsd35_cover.gif http://www.openbsd.org/images/openbsd32_cover.gif goldeneye!

another delicious feature which we shouldnt overlook.

The others have already mentioned the boot CD + FTP, but I'd like to add that OpenBSD is even easier to install entirely over the network. There's no need to waste time and natural resources burning anything to a CD.

This is very easy to do, and all you need is DHCP and TFTP on another machine. The rest of the process is exactly the same. See PXEBOOT(8).

There's this thing out there. It's called the Internet. Look into it sometime.

http://www.openbsd.org/cgi-bin/man.cgi
http://openbsd.org/faq/index.html

There's this thing out there. It's called the Internet. Look into it sometime.

http://www.openbsd.org/cgi-bin/man.cgi
http://openbsd.org/faq/index.html

It's all because Puffy's got the big guns, didn't you know? a true Playa.

It's all because Puffy's got the big guns, didn't you know? a true Playa.

Everybody is entitled to their own opinion, of course, but I personally think this release is a big deal. Contrary to what is usually the case with point releases, this one actually improves the state of the art - namely in security of Unix-like operating systems.

Some important security features have gone into this release (see, for example, this presentation), security that are almost certainly not found in any operating system you can mention. Besides the obvious benefit of making OpenBSD more secure, these features help catch bugs, and already some years-old bugs have already been caught. When these bugs are fixed, other systems using the software the bugs were in becomes more secure, too.

Personally, I am very impressed with how many security features the OpenBSD team manage to put in their system, without great sacrifices in standard-compliance and performance. I'm much more impressed by that than what great new features for games developers Microsoft has integrated, or how their new GUI toolkit makes their interface less ugly, or how Linux supports yet another hardware gadget, or how yet another distro promises that they will cause Linux to topple Microsoft.

In today's world that is run by computers, we need security. Worms, botnets, trojans, automated and directed break ins, website defacements, spam, and information theft demonstrate that we aren't there yet. OpenBSD seems to be the only OS project that seems to fully realize this _and_ have a production-ready system available. There is still much to be desired, but they're much further than the competition.

Two ways:

1. Make your own ISO (http://www.pantz.org/os/openbsd/makingaopenbsdcd. shtml)

2. Download an inofficial ISO (http://www.hup.hu/modules.php?name=News&file=arti cle&sid=9953)

Both of these steps should of course be followed by buying at least something from the OpenBSD store at http://www.openbsd.org/orders.html

So why not just quickly download and install it? Nobody is forcing you to buy the official CDs.

I don't think anyone would seriously use their PDA as a server, however. At least not in any kind of professional enviroment.

If you are serious about your infrastructure, you'll use serious tools, with serious software. If you're not serious, I guess you can settle for one of the ameteur projects which you can use on a motely collection of toys.

I don't think anyone would seriously use their PDA as a server, however. At least not in any kind of professional enviroment.

If you are serious about your infrastructure, you'll use serious tools, with serious software. If you're not serious, I guess you can settle for one of the ameteur projects which you can use on a motely collection of toys.

Get it on the bsd Release song page OpenBSD 3.8 CD2 track 2 is an uncompressed copy of this song.
MP3 song (4:24 minutes, 8.1MB)
OGG song (4:24 minutes, 5.6MB)
MP3 accoustic version (4:22 minutes, 8.0MB)
OGG accoustic version (4:22 minutes, 5.5MB)

Get it on the bsd Release song page OpenBSD 3.8 CD2 track 2 is an uncompressed copy of this song.
MP3 song (4:24 minutes, 8.1MB)
OGG song (4:24 minutes, 5.6MB)
MP3 accoustic version (4:22 minutes, 8.0MB)
OGG accoustic version (4:22 minutes, 5.5MB)

Get it on the bsd Release song page OpenBSD 3.8 CD2 track 2 is an uncompressed copy of this song.
MP3 song (4:24 minutes, 8.1MB)
OGG song (4:24 minutes, 5.6MB)
MP3 accoustic version (4:22 minutes, 8.0MB)
OGG accoustic version (4:22 minutes, 5.5MB)

Get it on the bsd Release song page OpenBSD 3.8 CD2 track 2 is an uncompressed copy of this song.
MP3 song (4:24 minutes, 8.1MB)
OGG song (4:24 minutes, 5.6MB)
MP3 accoustic version (4:22 minutes, 8.0MB)
OGG accoustic version (4:22 minutes, 5.5MB)

Get it on the bsd Release song page OpenBSD 3.8 CD2 track 2 is an uncompressed copy of this song.
MP3 song (4:24 minutes, 8.1MB)
OGG song (4:24 minutes, 5.6MB)
MP3 accoustic version (4:22 minutes, 8.0MB)
OGG accoustic version (4:22 minutes, 5.5MB)

Yeah, OpenSolaris really beats OpenBSD in every way, especially since it can run on the Sharp Zaurus PDA and 15 other architectures.

Yeah, OpenSolaris really beats OpenBSD in every way, especially since it can run on the Sharp Zaurus PDA and 15 other architectures.

OpenBSD don't do ISOs.
You have to use the FTP sites: http://www.openbsd.org/ftp.html

And yeah, they openly admit that this is becasue they want people to buy the CDs.
Please stop whining.

One of the most important things new in this release is the mmap(2) based malloc(3) implementation. I can't believe the submitter didn't mention it. It has huge implications, in terms of added security and increased code quality overall. Already, important off-by-one bugs have been found and fixed in X.org which had been sitting there un-noticed for years. These bugs could cause the X server to crash on many systems, but OpenBSD exposed them reproducibly so they could be fixed.

Read more about it in this Security Focus article titled Security-related innovation in Unix and in Theo de Raadt's post to misc@.

One of the most important things new in this release is the mmap(2) based malloc(3) implementation. I can't believe the submitter didn't mention it. It has huge implications, in terms of added security and increased code quality overall. Already, important off-by-one bugs have been found and fixed in X.org which had been sitting there un-noticed for years. These bugs could cause the X server to crash on many systems, but OpenBSD exposed them reproducibly so they could be fixed.

Read more about it in this Security Focus article titled Security-related innovation in Unix and in Theo de Raadt's post to misc@.

Fairly impressive list of supported hardware, too.

Fairly impressive list of supported hardware, too.

To see some of the current and new security features in OpenBSD, see this presentation by Theo.

Run pf on a 486 and use pf as your firewall, then you don't need MAC addresses and shizzle like that.

http://www.openbsd.org/faq/pf/authpf.html

Authpf(8) is a user shell for authenticating gateways. An authenticating gateway is just like a regular network gateway (a.k.a. a router) except that users must first authenticate themselves to the gateway before it will allow traffic to pass through it. When a user's shell is set to /usr/sbin/authpf (i.e., instead of setting a user's shell to ksh(1), csh(1), etc) and the user logs in using SSH, authpf will make the necessary changes to the active pf(4) ruleset so that the user's traffic is passed through the filter and/or translated using Network Address Translation or redirection. Once the user logs out or their session is disconnected, authpf will remove any rules loaded for the user and kill any stateful connections the user has open. Because of this, the ability of the user to pass traffic through the gateway only exists while the user keeps their SSH session open.

You mean, people like OpenBSD, or perhaps Debian, or Gentoo or ....
When you avoid screwing up your design the first time round, it does help that you need to do less work.

OpenBSD 3.8 will be released on November 1st which will offer a number of new features. Among the new features are several changes to the network stack that help reduce the imapact of DoS attacks. SecurityFocus conducted an interview with three of the project's developers in which they share more details about the upcoming release and this new significant change. Check it out and then please support a fine open source project!

API's, very dangerous. You go first.