Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenBSD's PF Developers Interview

Posted by Hemos on from the reading-all-about-it dept.

An anonymous reader writes "ONLamp.com has published a very long interview with 6 OpenBSD's PF developers: Cedric Berger (cedric@), Can Erkin Acar (canacar@), Daniel Hartmeier (dharmei@), Henning Brauer (henning@), Mike Frantzen (frantzen@) and Ryan McBride (mcbride@). Start reading from the first half and continue with the second part."

5 of 110 comments (clear)

  1. PF can Filers By OS by zulux · · Score: 5, Interesting

    One of the coolers things 'bout PF, is that you can add another layer of security to your systems - if you know that you'll never use a Windows box to SSH into your OpenBSD server - you can specifically deny Windows from connecting with a simple PF rule.

    It's great of VPN stuff - all of my VPN equipment is OpenBSD - so I just don't allow any packets from any other OS. This mitigates any attack - now my attacker has to have and OpenBSD computer (or at least spoof one)

    --

    Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.

  2. Re:OpenBSD problems by Anonymous Coward · · Score: 5, Interesting

    I've read the same thread myself, but I don't think Theo's temper is a problem for OpenBSD.
    Quite the contrary, actually.

    He has a project that's rock solid, and he doesn't want forks polluting OpenBSD's good reputation.
    I don't see why that's a problem. After all, OpenBSD is _his_ baby, and it's his call what to do with it.
    I'd probably do the same if I were in Theo's shoes.

  3. Re:OpenBSD problems by burns210 · · Score: 2, Interesting

    yea, it is his 'baby' but it is released under and open license, why SHOULDN'T i be able to fork openbsd if i want? If Theo wants an unforkable OS, he shouldn't have started by forking netbsd in the first place!

  4. Re:Wow by 0racle · · Score: 5, Interesting

    I personally have a lot of respect for the OpenBSD team, and the pf developers in particular, some time in the next week I'll be replacing my little Linksys with a OpenBSD pf firewall, and when I sat down to write the rules for it, it was amazing and appreciated how simple it is to write the rules, and that they're understandable at the same time. Comparing it to iptables that I saw once, the ease of writing the pf rules would have been enough for me to switch over. They also have that reputation thats not bad either.

    --
    "I use a Mac because I'm just better than you are."
  5. Re:pf vs ipf vs ipfw vs iptables by jimi1283 · · Score: 2, Interesting
    I can tell you, pf/ipf syntax is so easy when compared to iptables. And pf takes ipf even further by adding shortcuts to common tasks. For example, rather than setting up block rules to stop spoofing, you just do "antispoof for interface" and you're done :)

    I love OpenBSD for firewall/vpn duties... now if they'd just hurry the hell up and implement NAT-t for isakmpd i'd be a happy camper...

    --
    because what hunting rifle has a bayonet lug