Slashdot Mirror
OpenBSD 3.4 Released
tedu writes "We just couldn't wait another 2 days, so now you can enjoy OpenBSD 3.4 a little early and protect yourself from ghosts and goblins. More details at the OpenBSD website and official announcement. Remember to please use a mirror."
"Remember to please use a mirror."
And make sure you listen to the release song too. It's great :-)
The kernel has its own set of library functions, aptly named "the kernel library". This kernel library included strcpy() and strcat(), but not aymore.
Unlike 3.3, which made it months before a single security-related patch was issued, 3.4 LAUNCHES with 3 such patches.
That said, it's such a huge release in terms of changes made (x86 Write or eXecute memory pages, for one) that it's more than worth the upgrade.
As with most such fundamental updates to OBSD, though, I expect this release to be significantly patchier than the last couple.
--Ryv
Note thst strcpy() and friends _can_ be used safely, and the usage of the ones in the tree before the removal had been audited at least once. For example, the following construct is safe (assuming you check the malloc return):
len = strlen(foo) + 1;bar = malloc(len);
strcpy(bar, foo);
But is was easier to just banish them from the tree entirely, so that it is easier to grep for potentially unsafe ones when new code is imported.
1.6 Gbit/sec of AES-128? Damn, I gotta get me one of these!
This is before optimization is done, and according to Theo, this is what they are doing right now. The chip is capable of 12.5 Gbit.
If you did, you would how the ACTUAL OpenBSD developers responded to fefe's benchmarks.
For example, here is what Ted Unangst (a very major committer to OpenBSD) replied to requests for help improving performance:
"apply the patch below to your mmap benchmark. a real application is unlikely to use pread and mmap. openbsd uses a separate cache for read and mmap calls. while it seems you are attempting to time only a page fault with cached data, that is not happening on openbsd.
the results for all other OS should remain the same, but OpenBSD improves dramatically. the adjusted benchmark is a much closer match to application behavior in reality."
Which was followed by above-mentioned patch.
I don't think it's fair for you to judge an entire operating system community based on the contents of a few selected emails. By doing so, you are being just as biased as you say the others are.
The moving cursor writes, and having written, blinks on.
The two bugs you mention, weren't actually bugs
in OpenBSD.
* one was a bug in PAM and most GNU vendors
* one is a bug, but can't be exploited due to
W^X, propolice, NXSTACK, NXHEAP and friends.
Heck, I've tried the gobbles exploit again
against OpenBSD-2.9-OpenSSH where it worked
back then. It failed to run due to these four.
My Karma isn't excellent, damn it! (And