Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenBSD 3.5 Released

Posted by michael on from the security-takes-work dept.

pgilman writes "The word just hit the announce@openbsd.org mailing list: "We are pleased to announce the official release of OpenBSD 3.5. We remain proud of OpenBSD's record of eight years with only a single remote hole in the default install. As in our previous releases, 3.5 provides significant improvements, including new features, in nearly all areas of the system" including security, hardware support, software ports, and lots more. Support the project if you can by ordering the cds, or grab it from the net (use a mirror!). Thanks to Theo and the whole team!"

7 of 345 comments (clear)

  1. pfsync/CARP by ArbitraryConstant · · Score: 4, Interesting

    OpenBSD is the Cisco killer.

    It's now suitable for replacing a lot of the Cisco gear out there.

    --
    I rarely criticize things I don't care about.
    1. Re:pfsync/CARP by ArbitraryConstant · · Score: 5, Interesting
      I haven't had a router in a few years, but when I did have a couple, they were rock solid. I always assumed that a big part of it was the fact that they didn't have any moving parts.

      OpenBSD (and all the rest) don't need moving parts, except for the power supply fan. VIA Eden chips can run without a fan, and there are other chips from other architechtures with similar specs. The hard drive can be replaced by a flash IDE drive if your space requirements are small enough.

      Cisco still wins on speed when all you're doing is routing, and in many other situations, but the firewall isn't that impressive.

      Wouldn't the computer architecture make an OpenBSD router less stable?

      Not necessarily, it runs on a lot of different architectures... Xeon's, Opterons, PowerPC, MIPS, etc. If you didn't have to patch, uptimes of years wouldn't be a problem.
      --
      I rarely criticize things I don't care about.
  2. Re:Excellent by Lord+Kano · · Score: 4, Interesting

    How much traffic are you handling if you really need SMP on a firewall/router?

    LK

    --
    "Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
  3. Fast AES by atrus · · Score: 5, Interesting

    I found this part of the release notes particulary interesting:

    OpenSSL now directly uses the new AES instructions some VIA C3 processors provide, increasing AES to 780MBytes/second (so you get to see a fan-less cpu performing AES more than 10x faster than the fastest cpu currently sold).

    I don't know if the fanless assertion is right (the AES instruction is available in the newer (step 8?) Nehemiah processors, which I don't think there is a fanless version yet on the market.) Of course someone will prove me wrong.

    Now all VIA needs to do is make a network centric Nano-ITX board (drop the video, audio, firewire, usb, etc etc, and add in two more good ethernet ports), and this could be a serious IPsec/VPN platform.

  4. Re:never-been-rooted claims getting sillier by 0racle · · Score: 4, Interesting

    How is it getting sillier? Because they increment it once a year when there wasn't a hole that year, or are you just so used to using something else that you just cant believe that something goes longer then a month without a catastrophic security hole.

    --
    "I use a Mac because I'm just better than you are."
  5. My addition by bobtheheadless · · Score: 4, Interesting

    Everybody has their OpenBSD quips, so I may as well add mine.

    I've been using OpenBSD since 2.8 and have loved it since. It was the first UNIX-like OS I used. I currently use it on one box for my firewall, but have switched to gentoo for the web & mail servers.

    Thats not the best part though. I have some friends who needed a residential gateway, and I set them up with an old box running obsd 3.1, and its been running non-stop (aside from power outages) since, with no problems. I keep telling them I should upgrade them, but it really isn't required.

    Anyway, thats my addition. I wonder if anybody will have the paitence to read this far down in the comments. Hmmmm...

    --
    --- If I had a funny sig too, you might be laughing now.
  6. about security holes by Anonymous Coward · · Score: 5, Interesting

    Yes, lack of security holes makes anything secure, this is quite obvious. However, how can you know you don't have any security holes? The answer is simple: you cannot.

    If you call chroot a poor kludge, you're obviously not a security guy. Granted, it's not perfect, but it does help a little. Ever heard of the principle of the least privilege? The idea, that programs shouldn't be allowed to do anything except what they need to do? Well, taken to the extreme, this would mean:

    - Program should declare what syscalls it uses, what libraries it needs, etc, and no other syscalls/libraries would be allowed.
    - Program should declare what kind of access it needs to the filesystem to function. No other parts of the "real" filesystem should be visible in the program's namespace at all.
    - Same for every other resource such as sockets, etc...

    This could be achieved through a manifest file of some sort, which the kernel would read and interpret. It could be part of the program image itself. This would be truly beautiful, however anything that implements any of the above is a GOOD thing.

    You're saying chroot is giving a false sense of security. So, shouldn't the people be educated about what it solves and what it doesn't, then? Obviously it's a good feature, it just isn't intended to be a solution to everything. Just a solution to one problem: filesystem namespace visibility.