Slashdot Mirror
FreeBSD 4.0 Released
Claes Leufven was one of the first to write in with the news that FreeBSD 4.0 is
now available for download. Features added to 4.0 since it diverged
from 3.x include: IPv6 and IPSec support built in (courtesy of the
KAME project), OpenSSL and OpenSSH are integrated in to the base system,
jail(2) ("chroot(2) on steroids") to help build secure environments,
many, many NFS bug fixes and performance improvements, bug fixes and
performance improvements to the VM subsystem, netware file and client
connection support, gcc upgraded to 2.95.2 as the base compiler, better
support for laptops, a much more complete threads library. . . see the
Alpha or i386 release notes for more details. And before you all rush off to upgrade
your production servers, read on for a brief message from Jordan Hubbard,
FreeBSD's Release Engineer, and to find out where to download the release from.
"As with all FreeBSD releases ending in .0, the project recommends that production environments wait at least one or two releases after it before moving mission-critical services over. These dot-zero releases are primarily aimed at the developers and early adopters who are willing to work on refining the technology until it's production-ready. The 4-stable branch will also not be created until just before 4.1 is released, the period following a .0 release being the best time to collect serious feedback before branching the tree."
For a static list of mirrors, see this section in the FreeBSD Handbook. Alternatively, try Gavin Cameron's automatically updating list of mirror sites.
What part of FreeBSD "allows the option of using LinuxThreads for kernel thread functionality" did you not understand?
Did you even read the post?
Please
I am not an expert, but I believe FreeBSD has had user threads for a long time.
This release improves POSIX compliance and allows the option of using LinuxThreads for kernel thread functionality. Future releases will add native FreeBSD kernel thread functionality.
Yes, but isn't the key problem that you have to be a Doctor of Technology to use it ? (At least, preferably a Professor at Berkeley, but with a Doctor of Technology, you could at least use the FreeBSD system!) The last time I tried FreeBSD, it was 3.3....look, I have to admit the install was better than any Linux I've ever tried. In fact, it was probably the best OS-install that I've ever dealt with, and I'm not just paying lip service here. But a good install alone is not enough. As I've mentioned before, you have to be a Doctor of Technology to configure this thing. I couldn't even get the Linux programs to work under it, even though it specified after the bootup that Linux was already loaded!!! Another thing that's good about it, though, is the packages. They're extremely convenient. But there aren't enough of them. Anyway, make what you will of this post.
thank you. perhaps I will now stay in the open source environment.
slashdot sucks because of its readers. that and malda's crappy perl. VA has nothing to do with it.
You're a moron. The same problem exists on basically every unix os.
I am the author of the jail(2,8) feature in
m p.html
FreeBSD 4.0
The jail feature allows you to run one or more
"virtual servers" which for all practical intents
and purposes look just like a normal machine, but
which in reality are not.
The "real" system is protected from the jail'ed
roots actions, so that the root role in a jail
can be delegated to non-trusted parties.
This can either be used for "virtual servers"
(see http://www.servetheweb.com or Verios "vps"
product, both based on this code.)
Or you can use it for additional protection of
normal services. Create just one jail on your
machine and run your apache, ftpd and other
services in the jail, even if those services are
root-compromised, your machine will not be 0wned.
Amongst the things a jailed root cannot do are:
muck about with network config, operate RAW-IP,
create device nodes (and consequently can only
use the devices the "real root" has allowed him to), snoop network trafic, mount/unmount
filesystems,load kernel modules,replace the kernel, reboot the system etc etc etc.
All in all, a nice incline in the learning curve
for script babies.
At the SANE2000 conference I will be speaking
about jail in greater detail:
http://www.nluug.nl/events/sane2000/daily/24/ka
Poul-Henning Kamp
FreeBSD Core team member
phk@FreeBSD.org
I was always curious why some people are so proud to inform the whole world about their incompetency?
Most if not all Linux games run fine under FreeBSD linuxulator without performance hit. Why people run Linux games instead of FreeBSD-native ones? There aren't many native versions available and games alone are not a good enough reason to go back to Linux.
".. like some of the commands in Free BSD sometimes act a little whacky" That's relative. I jump on linux from my usual solaris and hp/ux and i notice things are a "little wacky".
Actually, they did the "security audit" mostly with "grep"....
i was right with you up till the multimedia part. if your audio needs extend past simple playback, you're gonna want linux, or Beos, or something that does SCHED_FIFO processes well. When I tried to run my synth code on FreeBSD, I had to jack the buffers up to about 40ms of latency to get no drop outs. Linux could do 10 pretty reliably, and with mingo's patches, 2.5. Beos is almost as good as patched linux.
But I suspect most users don't care. of course, most users don't really push their machines very hard (and this includes developers).
FreeBSD is excellent (and better than linux) for many things, but if someone claims its "simply better than linux," they, at best, have their head up their ass.
antialiasing? win32 and macos 9 do it for text at least. gnome canvas can be set to antialiased mode. dunno about be, but I assume it antialiases text at least...
"Linux ipfw is a 2.0-era feature"
.."
BSD ipfw is much better than ipchains and on par with nat and ipf in netfilter.
Netfilter with plugins will be fine and as good as ipfilter and ipfw though (since the developer has copied much of the model ipfilter is built on except it's more modularized).
"The BSD IP stack is lame
from the view of the majority of people with one processor, the SMP stuff will be mostly irrelevant. Dismissing the entire stack just because it's not threaded for SMP is stupid.
"Debian can update and upgrade from the net."
FreeBSD has been doing this for years as well.
FINALLY! wahoo! i'm glad to get it, mmmmm, BSD raul
scalability? try benchmarking linux and freebsd on a SMP machine. "blinded" indeed.
Linux has managed to always stay one step ahead of freebsd on SMP. Linux was finely grained locked when FreeBSD has the "kernel lock."
Now that FreeBSD is more finely locked, Linux has a multithreaded TCP/IP stack.
I predict that by the time FreeBSD gets a threaded TCP/IP stack, Linux will be fully preemptable.
You can make a pretty convincing arguement that when throughput is more important that latency, FreeBSD beats linux on single CPU. But if latency is your concern, or you have a SMP box, Linux is still the way to go for free OSes.
"Can you tell I'm a Debian user? ;)"
I run both freebsd and debian. I can tell you that they have very similar systems, just the way they went about implementing the commands was different.
The cool thing about freebsd I found, is that if I don't want to compile from source, I can upgrade from binary from current.freebsd.org daily..
I wouldn't recommend either way really. For most people, it's usually what they've used first, or what similar systems they have used. On uniprocessor machines there isn't much difference on benchmarks besides linux generally performing better under light load and freebsd under heavy load which is probably mostly due to default system values (as well as structure of both VM systems and partially the filesystems).
On monster machines with tons of processors, I hear linux is ahead, though I use SCO on monster x86 boxes so I would have no idea.
It's called system-wide crypto my friend.
Put it this way: You can encrypt your swap space.
'nuff said!
You seem to have a real agenda knocking OpenBSD, looking at your posts on this story.
you know, as soon as I typed loosers I realized it didn't feel right. thanks for embarassing me.
You're about 6 months out of date, partner. The ITAR export restrictions (the reason OpenBSD is in Canada) were changed to make provisions for public domain/gpl/bsdl/etc. software.
Does Linux suck? Hackers moving to FreeBSD. Then people bitch how Linux sucks. Yeah sure.
I first submitted this story early Wed. morning (EST) and it was only posted this evening. Wow, thats FAST. If linux 2.4 had been released, we would have had a story within 5 minutes. But then, Malda's personal opinion is that he doesnt give a flying flip about supporting anything open source but linux unless you submit a story. I know, I've swapped a few emails with him over the issue.
that's exactly what's wrong with FreeBSD. They can't attract developers for that very reason.
If you noticed, that person was canadian. Not European. And half the population of Europe also speaks better french than I, though it is one of the languages we speak in my home, and at school.
ipfw, netfilter, ipfilter al have that. Don't know what the guy before you was complaining about. I thin in 4.0 freebsd they only upgraded some of the stateful inspection. I myself prefer IPFilter because I can run it on both my *BSD, and Solaris boxes.
FreeBSD still lacks it. That's the only thing that makes me run Linux on my TR boxes.
rant
/rant
I guess this means all BSD licensed code is bad? People shouldn't use it because it can give an edge to the greedy corporations who will reuse their work and get paid for it?
Ok then, let's strip out job control and all the other innovations that come under the BSD license and just make do without them. While we're at it, let's lose all the embeded (IBM, etc) work people have done with BSD licensed code.
I guess that means you're left staring at a plain text screen with pretty colors on your filenames since Xfree is also BSD licensed, doing a single thing at a time without job control (perhaps if SCO still exists you can have virtual terminals). Sounds pretty boring to me.
An article back in December lined out the pros and cons of BSD/GPL, but the link doesn't seem to work anymore. The goods were here
apparently they only point to ftp.freebsd.org. when I first posted the link though it said there would be an iso... mcrandello
You're a moron. EROS isn't anything like UNIX, therefore the point that jail() is a limited hack compared to *EROS* is valid.
This isn't a flame or an anti-unix troll. I'm just wondering why the response's only point was to say that 'it can't be a problem, that happens in all unix os'
Well?
Hang on a sec.. which license is GNU Emacs under... hmmm...
oh wow. that must be exactly why BIND and Xwindows sucks.
How so?
Now if I could just get it (or Linux for that matter) to recognize my no-name ethernet PC Card for this Compaq notebook, I could make it at least as useful as when I run W95 on it... :-{
http://linuxuserforum.cjb.net
As far as I'm aware, most security audits focus on things like system calls or function calls that are known or suspected to cause potential problems in certain situations. You basicly go through the source and see how those are used.
A problem with automated testing is that afaik you can only test if something performs to its specifications. What is very hard to test however is what happens when an unknown variable (either internal or external to the process) takes an unknown value that is out of specification. Many security problems have a rather tight relation with trying to secretly change the pre conditions to make the proces behave differently then it was disigned. I don't see how you can reliable test that with an automated setup except for simply trying every possible combination of conditions, which sounds impractical to me.
Ehm... not really. The part about Linux having a multi threaded ip stack now is false, it will in 2.4 this summer. (and fbsd will likely in 5.0 somewhere end of this year or so)
Besides this, under heavy load on an smp box, Linux' throughput is better but its latency is worse, that is exactly why my smp box has both installed but is running fbsd most of the time.
ftp://ft p.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES /4.0-install.iso
Don't drop the soap.
The guy was complaining about Linux, not BSD. Anyway, ipfilter works pretty fine. The issue was that the ipfw and related tools in the *BSDs is better then that offered by linux.
As some extra argument I could add dummynet, ie, nuilt in bandwidth management.
ALso, making ipf rules with checks on the local uid/gid
As the representative of one-armed Yak herders, I take offense to the above statement. You'll be hearing from my lawyers, as soon as my houseplant-secretary types up the appropriate paperwork!
You think my English is bad? Then how is your French?
Well, at least you're not pre-emptively apologizing. That really gets me in the guilt department.
But my question is: why the hell does half the population of Europe speak English better than I do, when it's my native language?
> the installation of /bin/sh (just for memory footprint reasons).
>bash didn't
>have cursor keys or tab completion enabled, etc)
There's a good reason for this -- freebsd doesnt come with bash. bash is a highly bloated gpled application, and should not generally be
Bash is available via the ports system for those who wish it. *BSD takes the view that you should install what you want, rather than having everything you ever might think about wanting preinstalled for you.
And I heard a loud voice saying in heaven, Now is come salvation, and strength, and the kingdom of our God, and the power of his Christ: for the accuser of our brethren is cast down, which accused them before our God day and night.
hahahahahahahahahahaha !!!!! dude, you almost made me shit in my pants !!!
thanks !
It would be if it were "uebertroll".
Microsoft Windows 2000 [Version 5.00.2195]
:(
(C) Copyright 1985-1999 Microsoft Corp.
Did you think "2000" was the version number?
(Keep in mind that they skipped versions 1.0 and 2.0)
Just thought I would ask. It does seem to be one big omission.
That's right. You should stick with the most popular OS - Linux. Wait, make that Red Hat Linux. Wait, is it possible that there is an even more popular OS?
It is widely known that GPL attracts a better quality of developer. Given that fact, it is understandable that BIND and X Windows are pieces of crap. I love people who make ridiculous claims like this, backing it up with no proof, and say "PROVE ME WRONG!!!"... Some guys tried this before, they wrote a book about it called the Bible. Look where THAT got us! Moron.... IMO the "open source" movement has attracted hundreds of sub-par developers, all of whom run Linux and release under the GPL because its the thing to do. MY proof is freshmeat. Every single app announced is some garbage that already exists. YAUA -- yet another useless app. Everyone seems to love the 'yet another' prefix. Sheesh. BSD, what a breath of fresh air!
Moderators, this should be +5 insightful.
Funny, you sound a lot like Microsoft PR. What's good for the goose is good for the gander? Don't let yourself become a Linux drone.
BIND has more holes than a mob turncoat and X windows is the biggest piece of bloatware in existence. thanks for proving why GPL is the best license out there, you dumb fuck.
what you've just given us is useless. you're one stupid user. give me some stats from a wider study, idiot, and then maybe I'll believe you. Until then, all I see from you is cute anecdotes.
the license determines which developers work on the project. It is widely known that GPL attracts a bette quality of developer. Given that fact, it is understandable that BIND and X Windows are pieces of crap.
Prove otherwise.
And one more thing. I do know how to code. I suspect that you don't.
Suck my dick
You may also suck my dick.
How do you go from "this is bloatware" to "this license sucks"?
Is an ISO of the 4.0 release available, yet? It appears as though only the 3.4 ISOs are up on ftp.freebsd.org.
I'd say version 4.0 is something any 'linux' user
who has bagged FreeBSD should try.
Give it a go! How much could it cost? A few hours?
A gig of space?
Try it - if you don't like it - at least you can say you tried it.
Hmm... so where is your GPLed X? and a GPL:ed dns? (I'm sure there is a GPLed DNS, but just about every Linux comes with... surprise: XFree86 and Bind)
If the licence determines who is wanting to develop it then obviously GPL isn';t attractive enough for developers who want to write a X windows system.
I think however that the licence is not the major issue for people developing such products (tho some people feel strong about GPL for its 'virus' cluase, they are absolutely free to do so, and it is even quite understandable that people want that, but on the other hand, there are also people who think its more important that others can use their code, then how those others use it.)
Whhat GPL does is the same as what we call positice discrimination.. ie, it creates a set of rules with the purpose to force a change to a situation (ie, the way that people deal with writing and distributing software).
Anyway, there are GPLed Unix cariations as well as non GPLed ones... I can't say the same for X windows, and for quite a bunch of other tools and services, if developers would all go for GPL,. that situation would be reversed, ie, there would be a GPLed X and XFree86 would have died a long time ago (fyi, they just released a new version, they are far from dead), and the same would obviously apply to things like bind and apache, which are 2 of the most used services on the internet. (together with maybe something like sendmail, tho there are very good alternatives for that, both GPL and non GPL)
Now back to the original post, the licence may be a reason to try FreeBSD.
If you are a developer and care about what happens to the code you donate (in the sense that people cannot 'rip' it) then you should probably not look at FreeBSD as something to donate your code to. (I personally have no problem whatsoever when someone else uses code that I offered to the public for whatever purpose, including a binary only release of a derived product, but that is a matter of personal choice, please open your mind, people can have a different opinion then you and that does NOT, I repeat NOT make that opinion wrong per defenition)
If you are a developer for Linux code and want to only write GPL code, there is still a good reason to look at FreeBSD, if only because other systems, esp. ones that come with source, are a very good way to learn about different ways to implement things... broaden your horizon
For the user this stuff is of no importance whatsoever, in both cases they can run virtually the same software anyway
For a professional user however the BSD licence can give you a huge advantage in that you are explicitly allowed to create derived works and distribute them binary only. Most GPL adicts would almost get a heartattack from such things maybe, but it is explicitly allowed by the BSD licence, and the code was kept under that exactly because the developers want it that way.
If you use it in such a way as a company, it is wise to donate back your modifications after a while if those are usefull to the rest of the world. Why? because if your modifications are becomming part of the 'source' product, you don't have to apply them over and over when new versions appear. This simply saves money and so enhances the options to make a profit, which is what companies are here for.
To prove you that this works.. just goto the FreeBSD site and look who donated code and other support to FreeBSD.
For a company it is quite a thing to be allowed to do that because it allows you to keep the features you developed unique to your derived version, tho in practise only for a limited time (becauseof the donating back to BSD). As a result this company has a nice chance to make some extra profit, and FreeBSD (or any other BSD, the same applies to OpenBSD, and to some extend NetBSD) gains functionality.
If you believe in GPL, so do I, but I believe there is more and I won't close my eyes for that... most people with comments like the one this is a reply to seem to be blind.
What about Mozilla? That's not GPL, is it?
Debian can update and upgrade from the net.
The Linux filesystem layout makes perfect sense.
It is a mix of the best BSD and UNIX features.
You like what you already know though.
The BSD IP stack is lame. It is almost as good
as the Linux 2.2 stack, but Linux 2.4 is almost
ready. While BSD still has a big SMP lock around
the kernel (like Linux 2.0), Linux now runs the
IP stack on multiple CPUs at the same time.
Linux ipfw is a 2.0-era feature.
I think ITS or Multics was first.
I know UNIX was not first.
hehehe...
TCP/IP wasn't deployed on the ARPANET until 1983. DARPA actually paid Berkeley to integrate IPv4 into BSD Unix, and as a result it was the first system to officially support IPv4. There were other groups building IPv4 stacks at the time, some of whom claimed to have beat Berkeley, but BSD's implementation was the first to gain official status and was widely copied in incorporating IPv4 into other OS's.
what's that, no stats to be found? it figures. you BSD fags do a lot of talking but can't back up anything you say. stick with BSD, stupid asses. The world has already left you by anyway.
...
Although I must point out that there is no "box" to uncheck if you don't want to see software updates. This is something I think Slashdot is missing in a very bad way. To have avoided this story (which I wouldn't want to have done, but for the sake of argument lets just say I wished just that) I would have had to uncheck the BSD box, and that would mean missing out on all sorts of other good stories. Too bad.
Some people really, really like FreeBSD installation, some don't. Some do stupid things (like using the "Custom" or "Expert" install options without being experienced users) and end up hating it because it delivered the bullet to the place where you aimed the gun at: Mr. Foot.
Pros: the context-sensitive help is mostly ok; partitioning has an Auto option that makes reasonably-sized partition sizes; Standard installation will step you through all installation steps in the correct order (you will still get all the options available through a Custom install, btw); there are reasonable "distribution sets" that auto-select what should be installed depending on what's your intended use.
Cons: the interface has it's quirks, a result of the lousy UI library with which it was written half a decade ago; there is no set of "packages" to be auto-installed, which means you don't get many of the GNU goodies Linux users come to expect; it's post-install management is very poor; it won't configure packages; it does have a couple of bugs that cause crashes under certain rare situations; editing and compiling a new kernel are still required for some goodies, though things will mostly work.
Anyway, post-installation configuration help can be found on the handbook or the FreeBSD Diary. They are very useful resources, so do search them when you have problems or want to know how to do something.
Also, read the message that appears when you first log. It provides some useful references for the beginner. Finally, BSD man pages are good and useful. man and apropos are your friends.
.
I do not sure how FreeBSD fares with retail version,
but HeroesIII demo worked flawlessly on my FreeBSD 4.0-CURRENT box about when I tried it about one month ago.
After HOW long?
If you have multiple privileges on a system then there can be 2 cases:
- The designer knew in which situations which privileges are needed and gives them => inflexible
- You introduce the flexibility for the administrator to allow specific things in specific cases that otherwise would be privileged.
No matter how you implement this, you end up with some form of transition between privilege levels or by dynamically determining which pricilege is required when
setuid is most likely not the best implementation of this, but on the other hand, there is no way to do this perfect.
This is a problem in any system that recognizes different privileges, and usually introducing a more secure way also removes flexibility.
Imho setuid is not at fault but the people who use it without proper care are at fault
yep, that jail() call (and chroot, to a lesser
extent) are pretty nice under the circumstances,
but really a limited hack to work around a
problem that shouldn't be there in the first
place.
Stop whining.
Thanks for bringing it down to a lower level by personally attacking me.
I was making the point that OpenBSD already had those features as he had implied they didn't by saying FreeBSD had a leg up on them.
I'm not seeing the huge difference in the way FreeBSD deals with the RSA issues or the way OpenBSD does. I really don't care if they're different as long as they get the job done. These manual steps occur during the OpenBSD install and involves answering 1 or 2 questions. Its not that labor intensive. So I'm still not seeing how FreeBSD deals with the issue while OpenBSD does not.
My comment about paying up to use patented materials if your in the US... I'm not sure how your comment invalidates that.
But I don't think you care, really. I wanted to point out an inaccuracy about the security related software that comes with OpenBSD so therefore I'm some whining zealot.
XFree86 3.3.6
first of all I have seen a few minor issues with fbbsd 4.0 and xfree 4.0 when both were still in development, and I'm not too sure if those are solved already, and second, XFree 4.0 became available quite some time after the last moment it could have been added and properly tested for the FreeBSD 4.0 distribution.
> What makes openbsd so much more secure than any other OS like Linux, or more specifically, FreeBSD?
:)
They don't install any software with the OS, so since you can't do anything with it there is nothing to go wrong.
Seriously, OpenBSD is a pretty stripped down (but fully functional) OS that focuses more on audits and security through simplicity instead of feature bloat.
-----------
"You can't shake the Devil's hand and say you're only kidding."
It's "losers" not "loosers"
Why don't you just look up chroot sometime, it really isn't that difficult.
This is funny, at least in part its true I think, FreeBSD uses the more traditional BSD hierarchy for its filesystem and has a BSD style init for example. Seen from within the BSD world however FreeBSD are the ones that are not very traditional ;-)
In terms of stability, the two are pretty much neck and neck, AFAIK.
Hmm... I'd think that FreeBSD does a little better here.. only slightly.
In general stability is good in both cases, and hardly a reason to choose one over the other unless that little bit if extra stability does make a difference for you. /usr/ports, unless you have actually used it a few times you simply can't imagine how nice this is. It basicly provides sceletons for almost everything that is known to build on FreeBSD that will retrieve the source, apply patches, configure, build and install any of all those programs with just a single command.
What I find convincing reasons are for example:
- Being able to update (and upgrade) the entire distribution from the centralized source tree (using cvsup). No more problems because of library versions when upgrading to newer versions etc. You can track the development version (-CURRENT) which can be automated if you want so you can have the latest development sources etc on your machine, or you could track the STABLE branch if you are interested in having all patches and fixes and other updates after they are well tested.
-
- FreeBSD as mentioned uses a BSD style layout for its filesystem. This layout is far more consistant then the more sysV style layout that Linux (and most modern Unix variations) has, and because of that is easier to learn.
- FreeBSD behaves far better under stress then Linux. interactive response on a heavily loaded machine can get really bad with Linux, I have not seen that happen on FreeBSD, it gets slower, but its a long way to get it to a state where it becomes unusable.
- The BSD ip stack. This is the best documented and most widely used ip stack. FreeBSD has it with many enhancements.
- netgraph, which is far too much to explain here, but see this as something thats way cool if you are doing serious networking with different media.
- FreeBSD's ipfw + natd perform better, are more flexible and have better functionality then Linux' ipfw/masquerading stuff.
- With all those advantages, you are still able to run virtually any Linux app, so you can't loose
Please not that I'm running Free,Net and OpenBSD, as well as Redhat, slackware and debian Linux. All those have their advantages, and in many cases they are almost interchangable. Of those I prefer FreeBSD since it seems to combine most of the advances of Linux in hw support etc with the things that BSDs are traditionally good at.
can someone tell me what it does and why it is important? I am trying to understand why we would need a version on steriods (jail).
thanks!
- A.P.
--
"One World, one Web, one Program" - Microsoft promotional ad
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
OpenBSD isn't just NetBSD with a bit of crypto thrown in for good measure. OpenBSD is the first free operating system engineered with security as its primary goal.
Every line of code in OpenBSD has been audited, crypto has been used pervasively (not just applications, but in libc and the kernel) and the team is more than willing to say "no" to features which would negatively impact on security.
The first and last of the above points make integration difficult. Most people cannot be bothered and are not able to perform real security reviews and most people are more interested in features than security.
From bits and pieces I've picked up, it seems that FreeBSD is more conservative, more old-school UNIX style. Bear in mind that I say this as a Linux user, so I wouldn't say my opinion is all that authoritative.
In terms of stability, the two are pretty much neck and neck, AFAIK.
Isn't OpenBSD based in Canada because of screwy U.S. crypto laws? That might complicate a merge of it with the rest of the *BSDs.
AFAIK, they do a line-by-line security audit of the OS code and all their packages. They basically specialize in putting the system under tight scrutiny.
What exactly does this mean? Does FreeBSD have actual kernel support for userland threads now?
For example, can I write a multithreaded application and have the whole thing not block when one thread blocks on IO? I'd love that; it's what's keeping me from getting NASD running on FreeBSD now.
But why should personality clashes between Theo and the NetBSD developers prevent a merge between OpenBSD and FreeBSD?
Of course, the different focus on OpenBSD and FreeBSD might be enough to prevent a merge.
I believe it's the RSA public key algorithm that is coming out from patent this year, not DES. DES was made a US data processing standard for everyone to use, I don't believe it was ever patent encumbered in any restrictive way.
- jon
Ganymede, a GPL'ed metadirectory for UNIX
FreeBSD has always had two sets of crypto. One for the USA and one for international users. Typically the restricted code is not part of the release, and you need to specifically say that you are inside/outside the USA and the installer will fetch the right code.
For 4.0, with the integration of OpenSSL, the issue is not so much US export restrictions. It is the patent restrictions on RSA within the US. The solution is to have three possible states: No RSA, RSARef (only legal in the US and then only for noncommercial use or with a licence) and the international RSA code. 4.0 will dynamically link in RSA if you have the correct version, and print out an error message if you try to use RSA without the libraries installed.
-Jeremy
Umm.. for quite a while, before Linux if you consider the INRIA and KAME (integrated in 4.0) patches provided IPv6 connectivity since at least FreeBSD 2.2.8 (released Dec 1998). Try doing a little more research before you spout off.
Merci, mon petit chou.
I believe this open source project isn't getting anywhere mear the amount of attention it should considering its side and importance.
Does anyone else here share this opinion?
Could it be related to the fact that it is centered in Japan?
----
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.
What can be changed once can be changed again - if the main CVS servers were moved to the US, it would leave them vulnerable to future legislation.
AC wrote:
As a FreeBSD committer, you can rest assured that I knew about the release long before you did.
We had lots of submissions about this, most of them about the fact that the RELENG_4 tag had gone down on the source. Of course, this is next to useless for most people, because it's still not released and available on the FTP site.
We (or, more precisely, me) waited until I had confirmed that JKH had rolled the release, and that binaries had been picked up by a few mirrors. You can rest assured that there is no "pressure from above" to hold off on BSD stories, and that if there was, I'd be the first to talk about it.
N (nik@{freebsd,slashdot}.org)
Sorry to dip my little fly in your ointment: www.google.com is running GWS/1.6 on Linux.
Not meant as trolling, just as a small correction of your facts ;-)
Regards
tom
--
"Just believe everything I tell you, and it will all be very, very simple."
AFAIK, you cannot use either in the US due to use of the DES algorithm that is under a patent until the end of this year. Is FreeBSD allowed to release it now because of their partnership/ownership with/by BSDi???
Also, I was under the impression the stock OpenSSH/SSL still included bit sizes greater than the new limits on encryption export set by the Clinton administration (56/512 or 64/512 are they?). I could be mistaken though (no expert here ;-).
Any clarity would be greatly appreciated.
-- Bryan "TheBS" Smith
-- Bryan "TheBS" Smith
Independent Author, Consultant and Trainer
I work at a mostly Linux shop, but I admit I am interested. I inherited a Win98 machine as my desktop and pretty much have hated every minute of it. I am looking to partition up the drive this week and load some exotic OS on it.. a few questions, if you will my religious BSD-ers. I am sure these are covered in various FAQs and the like, but I can take advantage of this great resource called Slashdot and have you do some work for me.
.0 release are kinda scary. This will not be a production class machine or anything. My main duties call for me to ssh around to our various boxen and perform various admin-like duties on them. I assume it would be stable enough to handle these kind of conditions. What should I be worried about?
1 - There does not appear to be an ISO image available. Is this true? A URL for a 4.0 iso image would be heavenly
2 - Either way on number 1, I would also be interested in booting from a diskette, and doing an FTP install (a' la RedHat, and maybe other distributions too). Possible?
3 - I like KDE. Well, I like it more than any other Windowing System. Is this part of the standard 4.0 install?
4 - Sadly, I will still likely have to leave a Win partition. Does FreeBSD use LILO? I have a little experience with it, and would prefer it over another boot manager.
5 - The warnings about the lack of stability in a
6 - Heck, what's the word on 3.3? If I am installing it on a machine as I described above, should I just forget 4.0 and do the 3.3 thing? What about hardware support. The machine is a pretty much stock Dell workstation. It would be nice to run at a decent resolution and be able to play some MP3's through the sound card (I haven't checked, but I am sure it is a built in). I know the details are too sketchy for you to say for sure, but in general, do these things work out of the box for a 3.3 install? Is there better/more support in 4.0?
www.jackasscritics.com
The big draws of each, as I understand:
Free - largest install base. Oldest, most proven version of the BSD's.
Open - most secure
Net - runs on just about ever piece of silicon ever made. Old Sun 3/80's, old Amigas, serious old machines. They used to have more ports than Linux, and I think they still do have more, but the Linux crze is definetly helping Linux catch up to the work that the NetBSDers have been doing.
www.jackasscritics.com
*BAD EXAMPLE*
People could argue that that's bloated too.
Glückwünsche, haben Sie Slashdot ermordet, indem Sie zum korporativen Druck beugten und Subskriptionen einlei
He set out to write the world's most secure operating system and he succeeded.
:-), which will give EROS and its superior security model a chance to flourish again. No setuid stupidity here, just give programs the capability to access exactly that which they need to and no more.
;-)
...that is, until EROS gets rolling. And, believe me, it _will_ Real Soon Now.
The numero uno reason there has been 0 progress on that recently is that since the head honcho is currently working for IBM, the code he writes becomes their property. Since EROS is a GPLed project, there is a teensy conflict there...
Fortunately, Jonathan Shapiro has decided to leave IBM to work in academia
Of course, if you can't wait a year or so for security, then OpenBSD wins
Glückwünsche, haben Sie Slashdot ermordet, indem Sie zum korporativen Druck beugten und Subskriptionen einlei
Question:
What makes openbsd so much more secure than any other OS like Linux, or more specifically, FreeBSD? I think it is fair to say that FreeBSD is secure and stable in the extreme (case in point, Walnut Creek). So why is OpenBSD better?
I've been playing with FreeBSD 4.0 for a while, and the hardware support is truly amazing. Between the ata (anything ide) drivers and the pcm (sounds) driver, among so many other things (like FreeBSD's reputable networking), FreeBSD is truly amazing.
Post a link to the project and maybe it'll get more attention! The freeware community recognizes no geographical boundaries....
There is no such thing as definitive proof when it comes to opinion. If you write code, you choose a license that most appeals to you. If you don't, you use the software that does what you want.
What you seem to be asking is which license makes the best software, and again, no such proof exists, because it's the people that make the code, not the license.
It's often argued that the GPL is better because "I don't want some stinkin company makin any money off my code". They're going to make money off your code no matter which license you use. The difference is whether or not you want to see if they changed your code so you (and others) can use it too.
The quality of your code remains the same. Other coders who are Open Source advocates that pickup on your code are going to give their changes back of course, and in this case, the license doesn't matter at all. The code will improve.
So then if you still say, "But they're making money off my code," then it's no longer about the code really is it? It's about money, and if you were so worried about money, maybe you should have kept your source code closed and sold the program for a bundle huh?
This is why, if you're honest about Open Source, and respect what it can do, it doesn't really matter *which* license you use.
--
My comments and opinions completely reflect those of anyone and anything I am remotely associated with.
Even if you don't remember back far enough, you can always RTFRFCs.
The Internet not only started on Unix, it was born on BSD, as was Sendmail, Vi, etc.
--
My comments and opinions completely reflect those of anyone and anything I am remotely associated with.
www.kame.net
Why would you want that? Just out of curiosity. Sure, FreeBSD may have "sprouted" some security enhancements, but as you allude to, by no means is it on par with OpenBSD.
This difference is, of course, the result of the distributions being separated. Start combining them, sacrifices will be made. Just look at something like RedHat. Version 6 is becoming very Windows-esque in its size. Why is it so big? RedHat wants to market it to everyone, just like Windows. Go figure.
The point is specializing. Focus on one thing, you'll do it quite well, focus on several things, you won't do any of them nearly as well. I personally enjoy having the three distros. FreeBSD for my workstation, NetBSD on my old crappy hardware, and OpenBSD keeping the nasty world out. (Besides, I have no problems with an excuse to keep another computer around)
Mr. Ayo
-----------
"You can't shake the Devil's hand and say you're only kidding."
Just do a pkg_add XFree86-4.0.tgz and it's yours :) (hopefully)
No, It's a brand, but I wasn't expecting anything else but maybe (score 2 funny) :)
If high version numbers were of any significance, :)
win2k would be superior to anything
Versioning has a useage in real OS's, another
proof is the lack of multiple DLL's with different
versions in windows, where as UN*X can differentiate the so's with respect to their filename. (libc.so.3)
Its more an issue being a US business and wanting to pay or not pay RSA lisc. fees.
No, it's a result of RSA being patented in the US, but not in the rest of the world, and RSAREF not being available outside US because of crypto laws. But the fact is... FreeBSD deals with this issue for you, OpenBSD doesn't. OpenBSD requires more manual steps than FreeBSD.
So what he said is perfectly correct. Stop whining.
(8-DCS)
No, you don't. This is done at installation.
(8-DCS)
You could get a TCP/IP stack for the AT&T 3B2 in about 1985 but the perferred you to use thier 2mb "StarLan". Part of the massive rewrite of system V R4 was for better support of TCP/IP and other networks (which were already going away).
I suspect that novel is with us today because of their early business was to build hardware and software to help connect early military computers to the DARPA network. Some of these were then put on the Internet and some of them still are pingable.
Most of the very early stuff (ip v1, etc) was not done under unix but the rapid growth resulted from the easy access to BSD.
I was going to ask teh same exact thing. I'm just curious about other OS's, and I figure I might as well try some other Unixes other than Linux. So I'm guessing FreeBSD is the most user friendly? How does it comparet to the "ease" of Linux today? Does it come with X, and do you set it up during installation, or do you have to compile it yourself later on after installation? If you can run Linux "fairly well", would a *BSD be easy enough to install and use?
4.0 Finally out? Wow! I've been in the open source scene for about 4 years. I think in that time it was always in the 3.x series. Man that's almost as bad as Microsoft.
Wonder how many more years until it will be version 5.0
You're smoking something. 3.0 came out in October of 1998. Even then, the last release of 2.2, 2.2.8 came out in December 1998.
That's about one and a half years, not four.
-Corydon76
I believe that another difference, and seemingly now, more notable difference is that OpenBSD underwent a complete security audit whereas, to the best of my knowledge, FreeBSD did not. (although it's possible a complete FreeBSD security audit was just longer ago)
Chris Hagar
"The price of freedom is eternal vigilance." - Thomas Jefferson
All I see is yet another anonymous coward bitching someone who's actually trying to contribute something besides trolls and flames. Ha, imagine that.
Welcome :)
Shiite, ubertroll is the *PERFECT* name for this guy.
file:
I must say that I'm glad to see that the Linux people aren't waging a holy war trying to say that this belongs on freshmeat this time. That out of the way, I'm pretty happy that this release is out. I've been holding of trying FreeBSD until 4.0 came out and this gives me a good excuse to hit cheapbytes.com for a purchase :) Anyway, has anybody used 4.0 yet? I noticed that the release talked a lot about performance improvements in various places, particularly the VM subsystem. Do these amount to much? Also, exactly how suitable is FreeBSD for the desktop? It seems much more organized than Linux, and they seem to tweek it quite well. I've heard, however, that multimedia on FreeBSD isn't as evolved as it is on Linux. Any substantiations to these?
A deep unwavering belief is a sure sign you're missing something...
I'm not convinced that OpenBSD's "increased security" is significant enough to justify using it over FreeBSD or NetBSD. Except I'm going to be likely to start off a religious war with THIS one.
-bugg
2.2.8->3.0 was aout-to-elf, however.
-bugg
I realize this. Lite/2 was CSRG's followup with bugfixes. But this isn't the major, painful merge that you make it out to be. It wasn't something that had to be done for 3.0, or technically had to be done at all.
So it isn't an excuse for the time of the release cycle (which doesn't need an excuse, by the way), is my point. Using the fixes in lite2 didn't make the path to RELENG_3 harder. It made it easier.
-bugg
Erhm.. If you can install Slack, you can manage *BSD. From what I remember, the disk partitioner is a bit dodgy in Free(at least in 3.3), but not more so than cfdisk was with 1.2.xx. X comes with it, but you have to manually configure it with xf86config or startx --configure. No real suprises to the install.
Try it.. Oh, and don't freak out when you 'free' and see half your memory gone; FreeBSD has a different memory management style than Linux.. I've had more than one frantic email over that!
.sig: Now legally binding!
Its not under the GPL.
It's not an emulator - it's linux ABI compatability. Basically, the kernel loads in a different system call interface when running a linux binary, and so the binary can make all of the native linux system calls it expects while running on the bare hardware (i.e. not from a virtual machine).
Basically, the FreeBSD kernel reconfigures itself to look like a Linux 2.2.x kernel from the point of view of a linux binary ("I can't believe it's not Linux!") - quite cool, really.
See http://www.freebsd.org/handbook/x20065.html ("How does the Linux mode work?") for a more detailed explanation.
Minor nit: ftp.cdrom.com and ftp.freesoftware.com are not the same machine. ftp.cdrom.com was sold off by Walnut Creek CDROM (it still runs FreeBSD - they're not stupid and need to keep up with the load), but ftp.freebsd.org is now hosted on ftp.freesoftware.com, also running FreeBSD on a similar platform.
Theo was one of the 4 founders of NetBSD. Lets include ALL the facts people.
Guess who OS had the fine grained locks and multithreaded IP stack and kick linux's ass in benchmarks.
NT.
No, it's under a REAL free license. BSD is really freedom, GPL is kindda supposed to be free but has clauses (kindda like communism :P).
the license determines which developers work on the project. It is widely known that GPL attracts a bette quality of developer. Given that fact, it is understandable that BIND and X Windows are pieces of crap.
Not, I find BSD development to be much more focused. Everyone who's not blinded knows BSD is superior to Linux in terms of stability and scalability. Apache (which linux advocates love to hug) is under a BSD license too if i recall correctly.
don't know any other OS that does that.
to prevent from being completely off-topic, Mac OS X has some freebsd stuff it.
>It is widely known that GPL attracts a bette quality of developer.
Eh? Do you have proof of this statement?
If it was said on slashdot, it MUST be true!
>what you've just given us is useless.
And you have enlightened us ALL with your quotation of links to wider studies proving Linux is superior.
Thank you for the heat, and no light in your flames. We have a cold snap going on.
If it was said on slashdot, it MUST be true!
>Nobody is going to complain
If you notice, the nobodies ARE complaining. Look at all the BSD suck messages.
If it was said on slashdot, it MUST be true!
Another *really* nice feature was that FreeBSD autodetected my 3com SOHO Officeconnect nic, which Redhat and Mandrake could not. I had to download the source and recompile the kernel to get the nic to work on Redhat, and for some reason the same code never worked on Mandrake.
FreeBSD has a cool initial kernel config which identifies conflicts while you select your hardware and counts down the conflicts as you resolve them.
All in all, very impressive and very nice after installation too.
[Groan] - and I have plans tonight. Oh well, I guess the servers will have a chance to calm down and I just have to do that tomorrow :)
I don't think it is the slightest bit difficult. There is an option for using the whole disk, specifying your own size (in MB's if you prefer) and it will auto partition into /usr, /boot, and swap partitions. Really nice, I thought.
That said, I could not even install the Linux emulator on FreeBSD 3.3. It was the only thing that locked the machine on install. :(
After reading all the visible posts, I see a lot of complaints about licensing. One person in particular said "its not under the GPL."
I challenge anyone to give me definitave proof why one is better than the other. Different situations and/or different goals require different styles of thinking.
I personally run Linux, FreeBSD, NetBSD, and Solaris on a wide range of machines. I even run a pre -RELEASE 4.0-CURRENT on my server and a partition on my predominantly Linux box. I don't pay much attention to the licenses, as long as it is free software, I don't care! GPL, BSD, whatever, if it is free, it works for me. If you're a big company and want to deliver a propriatary solution, BSD-licensed code might be better for you. If not, GPL is just fine.
Now, onto the new FreeBSD. I must say that the new IDE/ATA driver is much superior to the old one. I'm happy that I no longer need a gcc2.9.5 package installed, and the OpenSSH/OpenSSL stuff is great. I had to rewrite the entire kernel configuration file for both machines because the new release changed a lot of the syntax. All in all though, I was suprised to find that the upgrade to 3.4-STABLE to 4-CURRENT wasn't as painful as I thought it would be.
I'm enthoozed about the new jail feature, and I can't wait until the BSD/OS code is merged in (5-R).
Cheers,
Sean
Try the link below in a little while for ISOs...
1 28471
http://fileforum.efront.com/detail.php3?fid=953
(some URL surgery may be neccesary). Of course they'll like be up at the FTP sites at that point but if they're getting clobbered...
mcrandello@my-deja.com
rschaar{at}pegasus.cc.ucf.edu if it's important.
I started installing FreeBSD in earnest around Xmas 1999 and I'm still working to get it the way I want it. But that's because I want it EXACTLY the way I want it. And I haven't even looked at half of what it offers yet. The honest answer to your question is yes, BSD is very easy to install but it's a bitch to configure - a beautiful curvaceous bitch who gives you wet dreams. Here's wishing you many happy silo overflows.
Adam:What kept you?
God:Rome wasn't built in a day
When I did my run through OpenBSD, I used /usr/ports to install enlightenment. After what I believe was about an hour of download (its not on this ftp site, try the next one) and compiling, it never did work right, without a SEGV. Being a Debian user, used to apt, I saw this as a step down, but if you prefer it, more power to you.
Hate to nit-pick here. I know that the switchover to 4.4Lite was done for 2.0. But there was a second release of 4.4lite called 4.4lite2. This was integrated in for 3.0. If you don't believe me, I can show you the CVS tags.
"I shoulda never sent a penguin out to do a daemon's work."
Cat, the other, tastier white meat.
The 4.0 development branch spun off of the 3.x tree back last January '99. I don't consider 14 months to be a incredibly long development cycle. Going from 2.2 to 3.0 took a long time (a few years IIRC), but it also involved the codebase switch to 4.4Lite2, along with i386 SMP and Alpha introduction. None of those were trivial tasks!
"I shoulda never sent a penguin out to do a daemon's work."
Cat, the other, tastier white meat.
Tommy - FreeBSD hacker
Tommy
this should have been scored higher!
[off-topic]
Is this anti-aliased?
I'm impressed.
and that's a bold statement for an athiest :-)
.cig - what you do after winning a good flame war
I believe that encryption regulations are being relaxed, in the near future, as the US now thinks other people are grown up enough to use it, so this shouldn't be relevant after a while.
Its nice to have IPSec and OpenSSH built into the base system, but since FreeBSd is based in the United States, how will they distribute strong encryption such as Blowfish? Will we only be able to get it from foreign (or Canadian) sources?
OpenSSH is nice, but if you can only get 40bit, why bother?
Jailbrekr.
Feed The Need[goatse.cx]
My apologies. Wrong/misleading subject heading.
I shall go eviscerate myself now.
JB
Feed The Need[goatse.cx]
I'm not sure about the dates, but I'm under the impression that the precursors to the Internet date back to the 1960s, the Internet itself (IPv4, TCP, UDP) appeared in about 1980, and Unix didn't support Internet protocols until the early 80s.
I could be mistaken about this. I personally didn't know the Internet existed until 1989. Is there anyone here who remembers back far enough?
AMC
Well, I think that if something that is for nerds and that does really matter, it is the release of such a major piece of software.
So please don't bother us with your complaints, and just go uncheck that box.
guillaume
---
You think my English is bad? Then how is your French?
give me all your garmonbozia
Theo heads up OpenBSD
see: http://www.theos.com/
Read more of this story at Slashdot.Read more of this story at Slashdot.Read more of this story at Slashdot.
And apache too.
You can see it particularly with apache.
No one uses it because it's not under the GPL. And there's next to no development done on it.
If apache moved to the GPL, imagine what it could do - heck it might even take over half the web-server market.
(Now I watch for the sarcasm impaired folks to reply)
Read more of this story at Slashdot.Read more of this story at Slashdot.Read more of this story at Slashdot.
What are the major differences between Net, Open, and Free BSD's? It seems Open is most secure, Free is most popular(?) and Net, I have no idea....
Well, I've always found FreeBSD installation to be surprisingly painless. The biggest difference that I've found is that FreeBSD programs install very close to default. Most Linux users are used to getting a KDE/Gnome desktop pre-configured with massive amounts of software. FreeBSD doesn't do this. BUT, it makes up for it.
/usr/ports/x11/gnome && make install
You see, FreeBSD has a feature that only debian seems to rival for pure beauty. It's the ports directory. To install gnome, for instance, it's cd
and there you are, it'll fetch everything it needs, checksum the files for validation, and ramble on nicely.
I used to be a huge Linux fan. I still love Linux, but prolonged exposure to the BSD family as well as Linux has raised my desires for an OS almost unreachably. Try it, use it for a few months, and enjoy all the *ixs.
----------------------------
I would say from personal experience, that I found Linux more comfortable than FreeBSD coming from a Solaris background (or more specifically Solaris 2.5.1 and 2.6 with a GNU utils to replace the braindead Solaris ones).
/usr/ports is the coolest thing I have ever used on any platform and is the reason I plan to try FreeBSD again now that I have a better network connection.
That being said, I think
--
"L'IT c'est moi!"
I wonder if they use any tools for program validation. Stuff like the boundschecking gcc, or stuff similiar to Purify. Is it really only experienced devlopers staring at the code? Guess the NASA does er.. did slightly better in the past.
I'm not convinced that OpenBSD's "increased security" is significant enough to justify using it over FreeBSD or NetBSD. Except I'm going to be likely to start off a religious war with THIS one.
A system like FreeBSD is evolving quickly. Every day lots of lines of code get changed. Not every change has implications that are easy to grasp. To me, not experienced in security auditing, only exposed to theory of program testing, this looks like I either have a secure but slow evolving system or a quickly evolving system with potentially new security holes opening up.
Let's take the change to IPv6 for instance. You can't tell me that this will not go hand in hand with a lot of holes.
Back to automated testing:
I know that this is very hard to be done with complex programs, one reason being that it is not easy to come up with a formal specification to test against. I also don't expect that someone is able to give pre- and post conditions for every statement. But it should be able to perform a lot of the static and dynamic tests that are known to computer science.
Is this methodology not used in the domain of operating systems security or do they not talk about it? Or is it simply not possible or useful?
You should have no trouble at all with already ported Linux apps. For example try this
marc@oranje$ cd /usr/ports/www/linux-netscape47-navigator
marc@oranje$ make install clean
marc@oranje$ netscape
and you can fire up Linux Netscape after a while.
For non ported applications the only trick to know is that a Linux binary perceives the file/directory hierarchy a bit different - it sees all stuff beneath /usr/compat/linux/usr as beneath /usr. Example:
marc@oranje$ pwd
/usr/compat/linux ../bin/bash # Linux bash /usr
/usr /bin/pwd # a pwd within FreeBSD
/usr/compat/linux/usr # you see the mapping?
marc@oranje$ uname
FreeBSD
marc@oranje$
marc@oranje$ uname
Linux
marc@oranje$ cd
marc@oranje$ pwd # a pwd within Linux system
marc@oranje$
marc@oranje$
Hope that helps - if not seed me an e-mail!
>Being relatively new to the world of *nix,
/etc/X11/XF86Config or download a XFree server binary...)
>is the installer for this new BSD or any other
>fairly "friendly"?
It sounds like you're ahead of the curve (i.e., clueful of what to do at a shell prompt, knows
the what and why of disk partitioning at least for workstation configs, won't totally freak out if you have to add your HorzSync and VertRefresh to
The installer for freebsd is a fairly friendly dialog-based script; the packages are tar.gz's.
Check the supported hardware before you even start though, as you should do for any os.
There are a few potential snags, but if you thought installing suse and slackware was easy, you'll be able to install freebsd in your sleep.
-fb Everything not expressly forbidden is now mandatory.
I tried FreeBSD 3.3 a few months back. There were a few things I liked about it (Linux' partitioning sucks real bad by comparison, etc) and a few I didn't (media auto-detection on my network card didn't work, the installation of bash didn't have cursor keys or tab completion enabled, etc) but by and large I didn't see enough interesting in FreeBSD to make it worth my while learning how to do the things that it does differently. By the same token, I don't imagine the average *BSD user would find much in Linux that would be worth learning all the differences, either.
We're on the subject of FreeBSD and its newer security features, which I find very cool... but in the process of our conversations I've noticed quite a few errors in the posts tonight which covered FreeBSD's cousin, OpenBSD. Errors which could erroneously tarnish people's images of the OpenBSD system. I would really like to point to the OpenBSD website to get some correct facts. Unfortunately its so late in this article's life span, I doubt anyone will actually read this.
As seen somewhere in the posts:
>OpenBSD is more secure because 'they' say so.
>Now, why do 'they' say this?
>At one time, all the code was gone through line >by line looking for problems.
My response: (and other responses to other concerns follow. I qoute the OpenBSD website alot.)
Its not "at one time" as in past tense only concerning the security audit. Please read the security section-audit process of the OpenBSD website:
We have been auditing since the summer of 1996. The process we follow to increase security is simply a comprehensive file-by-file analysis of every critical software component. We are not so much looking for security holes, as we are looking for basic software bugs, and if years later someone discovers a the problem used to be a security issue, and we fixed it because it was just a bug, well, all the better. Flaws have been found in just about every area of the system. Entire new classes of security problems have been found during our audit, and often source code which had been audited earlier needs re-auditing with these new flaws in mind. Code often gets audited multiple times, and by multiple people with different auditing skills>.
The most intense part of our security auditing happened immediately before the OpenBSD 2.0 release and during the 2.0->2.1 transition, over the last third of 1996 and first half of 1997. Thousands (yes, thousands) of security issues were fixed rapidly over this year-long period; bugs like the standard buffer overflows, protocol implementation weaknesses, information gathering, and filesystem races. Hence most of the security problems that we encountered were fixed before our 2.1 release, and then a far smaller number needed fixing for our 2.2 release. We do not find as many problems anymore, it is simply a case of diminishing returns. Recently the security problems we find and fix tend to be significantly more obscure or complicated. Still we will persist for a number of reasons.
The auditing process is not over yet, and as you can see we continue to find and fix new security flaws.
Concerning comments about how OpenBSD doesn't install 100's extra non-vital programs by default (somehow making it bad), or have "xyz" service enabled - I go back to the OpenBSD website again:
To ensure that novice users of OpenBSD do not need to become security experts overnight (a viewpoint which other vendors seem to have), we ship the operating system in a Secure by Default mode. All non-essential services are disabled. As the user/administrator becomes more familiar with the system, he will discover that he has to enable daemons and other parts of the system. During the process of learning how to enable a new service, the novice is more likely to learn of security considerations.
So here's my thoughts.. If you want Foo app. Get it. Install it. Use the ports. The whole point of OpenBSD is to be secure and correct. Some of the philosophies which they use to achieve their goals may rub you the wrong way. Thats ok, don't use OpenBSD. Please just don't unnecesarrily disparrage it. I've just noticed an overall trend of a lack of understanding of the OS here on multiple posts and I wanted share a few concerns I had.
Oh yeah, I forgot. The license determines the bloat and cruft. Thanks for reminding me. Now go learn how to program.
A Government Is a Body of People, Usually Notably Ungoverned
Can someone please confirm whether Tom is indeed dead?
No, I'm sure he's not dead, otherwise it would have made Slashdot headlines. He probably got fed up with these goddamn trolls and the rest of the bullshit that Slashdot's comments section has deteriorated to and moved on to better places. I'm starting to get fed up with it as well.
"Software is like sex- the best is for free"
-Linus Torvalds
Yep, it's done installing now, I'm typing this from my new FreeBSD box :-)
/usr/ports RULES!!! All I did was:
/usr/ports/x11/gnome
:-)
cd
make install
Wow... it downloaded gnome, realized it needed gtk, gnome-libs, and a bunch of other stuff, downloaded that, compiled, installed, and worked PERFECTLY. Wow. Another FreeBSD convert here (and I've only been running for 15 minutes!
"Software is like sex- the best is for free"
-Linus Torvalds
As a longtime (6+ years) Linux user, I'm installing FreeBSD 4.0 right now. I've never used it before, so we'll see how it works. /usr/ports sounds verrrrry interesting...
:-)
:-) (although I've been kicked off probably 10 times in the last 5 minutes.... I want to go smoke a cigarette but want the install to keep going....)
As a side note, though, the damn FTP server keeps kicking me off and I have to keep reconnecting, and none of the other servers have 4.0. Well, it's a good thing this FTP install is well-written and I don't have to start over every time
Anyway, I'm getting 70 KB/sec when it's working, so I guess it's not slashdotted too horribly
"Software is like sex- the best is for free"
-Linus Torvalds
I'm NOT a BSDite, so I have no way of knowing the answer to this question: Who is Theo?
Hey Rob, Thanks for that tarball!
"Going to war without France is like going deer hunting without your accordion." - Jed Babbin
Does anyone know which version of X is included? I couldn't find any references to it in the release notes.
Cthulhu for President!
(darren)
My last linux installs were debian 2.0 hamm and redhat 5.something
Yes, FreeBSD's installer is considered the most userfriendly. I find an install easier, and more powerful (Do a "Standard" install, the power of Custom is there, except it makes it harder for you to shoot yourself in the foot) than either of these two Linux distributions.
Yes, you can set up XFree86 during installation. With either Windowmaker, fvwm, KDE, or Enlightment (maybe another choice?)
Yes, a FreeBSD install should be very easy to install and use. /stand/sysinstall will hold your hand while you get used to the system. /usr/ports will make software installation easy. You don't outgrow ports (But you'll outgrow sysinstall for post-installation administration)
-bugg
For one thing, it's relatively stable and scalable.
This is why companies like Hotmail, Yahoo!, Google, and the world's largest anonymous ftp server (ftp.cdrom.com, a.k.a., ftp.freesoftware.com) use it. Note that slashdot uses FreeBSD for certain functions, and the staff have spoken highly of it.
Because of the BSD license, it's easier for companies to take it and make embedded systems out of it. This is why companies like IBM/Whistle use it in the InterJet and InterJet II, not to mention the GNATbox, the NetWolves FoxBox, the Stallion ePipe, etc....
So, since you get your mail at hotmail.com, you can thank FreeBSD for being so stable and scalable!
--
Brad Knowles
Brad Knowles
http://daily.daemonnews.org/ -- if you're not
Unfortunately there are some age-old personality clashes that have left very deep wounds (like serious threats of physical bodily harm), and the problems underlying are not likely to go away any time soon.
I anticipate that there will be increased overlap between FreeBSD and the other members of the BSD family, as the folks at BSD, Inc. go out of their way to work closely with developers in each of the other camps -- to the benefit of everyone involved.
Whether Theo will ever come in out of the cold is another question entirely, however.
--
Brad Knowles
Brad Knowles
http://daily.daemonnews.org/ -- if you're not
...run Lokisoft games? I know Civilization Call to Power runs under FreeBSD 3.2 but Heroes III didn't. Has anyone got it to run under FreeBSD 4.0? These are important issues when choosing OS :-) Most Linux distributions are such a mess that I'd really rather run FreeBSD.
-- SIGFPE
I have never installed BSD on either an X86 or Mac based machine. Being relatively new to the world of *nix, is the installer for this new BSD or any other fairly "friendly"?
I have installed Red Hat V4 and up and found them very easy, Slack the same, and Suse could be installed by a one armed, blind, Yak herder with the IQ of your average houseplant. Those installers were all not only easy, but detected most of my hardware on installation except Suse, which didn't use my sound card until I re-built the kernel, NBD.
How is BSD for that? I would like to have a go at it some time, but unfortunately my time for tinkering with new OS's is fairly limited so I prefer the installation to be as painless as I can manage.
Ceci n'est pas une sig.
I met Theo at Beyond HOPE (Hackers on Planet Earth) in New York in the summer of 97. Besides being a cool guy, he did seem to have some pretty deep seated bad feelings about the NetBSD team. If his feelings then are any indication, it's not likely he'll ever work closely with them again.
...and why should he? He set out to write the world's most secure operating system and he succeeded. I'm hate to see a codebase fork as much as the next guy, but we've got a great product here... OpenBSD doesn't try to be all things to all people and that's exactly what we needed.
BRENT ROCKWOOD, EST'd 1975
I like Free BSD , but sometimes I wonder about it.. like some of the commands in Free BSD sometimes act a little whacky, but every operating system has its quirks, Free BSD is no exception.
In my home I have two Free BSD boxes, one is basically a web server and the other does mail and ftp.. Free BSD has proven a good solution for my needs and i wouldn't give Free BSD up. GNU/Linux still fulfills my needs for a Great Workstation and dialup ppp server, all in all Linux and Free BSD are nice packages.
wow you sound pretty convincing.. but i dont have $300 to spare for a new OS
Windows 2000 Professional is the operating system for desktops and notebooks for all sizes of business. Windows 2000 Server is an entry-level solution for running more reliable and manageable file, print, intranet, communications and infrastructure services. Windows 2000 Advanced Server includes additional functionality to enhance availability and scalability of e-commerce and line-of-business applications.
Gee- ZDNET and CNet both have managed not to mention this at all. IPv6, for example- talk about a buzzword feature! Yet not a peep.
But perhaps I ask too much. Maybe they will bring themselves to mention this sometime soon. Or maybe OSS will continue to be synonymous with Linux as if Linus invented Open Source. Not that I dislike Linux or Linus, but it irks me that it hogs the spotlight so. BSD is STILL more mature in many(most?) ways, and, as this pays testement, is still improving.
*sigh* - At least there will always be Slashdot.
-N
I am the one true god. However, as an atheist, I don't believe in myself. I guess I have a self-esteem problem.
A leg up on OpenBSD?! OpenBSD already has OpenSSH and IPsec. And yes, during install you can choose the US or International crypto, but OpenBSD is done out of the US, so lame-laws need not directly hinder it. Its more an issue being a US business and wanting to pay or not pay RSA lisc. fees.
OpenBSD and its dev's played a big role in OpenSSH.
OpenBSD places alot of importance on security and doing it right. Read all about it and get facts.
http://www.OpenBSD.org
http://www.openssh.com
I have worked with both Linux and FreeBSD, and can say that both are stable, and fast. It is good to see FreeBSD take an upgrade on GCC and the threaded libraries. The only reason I can see to chose one over the other is that some people prefer a BSD style environment over the POSIX/SYS5/BSD hodgepodge that Linux offers. Both environments are very good, and none is necessarily better than the other. Choose whatever you are most comfortable with. If you come from SunOS or even Solaris, then FreeBSD is probably a better fit. If you come from AIX, SCO, or HP/UX than Linux is probably a better fit. If you are new, pick either, you can't go wrong. Ofcourse, this is just my humble opinion. Anyhow, congrats FreeBSD folks, keep the up the excellent work!
-Master Switch, one more element in the machine
OpenBSD has traditionally differentiated itself by being way ahead on the security front. Hell, look at their cryptography pages - "because we can". And a damn good reason for doing something that is too. But, the world is changing now: FreeBSD has just sprouted a serious number of security enhancements, and the "because we can" argument is starting to look watered down.
:)
So, maybe we can add to some of that "BSDi are integrating their code" good feeling by starting to patch things up with Theo and the OpenBSD crowd. Note that it's important to not underestimate the quality of work that has gone into OpenBSD - you're not going to buffer overrun that bastard, believe you me.
And please, no FreeBSD RULEZ! OpenBSD SUX! crap (or vice versa). It just seems like a great opportunity to make three great server OS's (BSDi, FreeBSD, OpenBSD) into one absurdly great server OS.
Dave
I write a blog now, you should be afraid.
What they've done is actually quite cool. They have linked the crypto libraries to stubs, and the stubs reference either the US or export versions of the crypto libraries (as appropriate for your system), and if you don't have either installed they issue an error message that tells you how to install them.
This is handled automatically during the normal install procedure, so the right crypto stuff is grabbed from the right archive site, and it all just plain works.
Way cool, and a leg up on even OpenBSD as far as this is concerned!
--
Brad Knowles
Brad Knowles
http://daily.daemonnews.org/ -- if you're not