DragonFly BSD Announces 1.0RC1
CoolVibe writes "Matt Dillon announced the availability of DragonFly BSD's 1.0 Release Candidate #1. Get it at Dragonfly BSD's site (please use a mirror or post mirrors as comments). Changes and features include: variant symbolic links, UDF support, lightweight kernel threads, message passing, GCC 3.4 in the tree, binutils 2.14, Kernighan's awk 2004-02-07, BIND 9.2.4 rc4, CVS 1.12.8, libpcap 0.8.3, tcpdump 3.8.3, less 381, MMX/XMM kernel optimizations are now on by default, greatly improving bcopy/bzero/copyin/copyout performance for large (>4K) buffers, XIO, acpica5, new AC'97 codec support, network stack revamping, long standing bug fixes for wide variety of support and stability issues, and way, way, way more. A new installer is also in the works that uses DragonFly's new CAPS IPC mechanism. The installer beta is available from LiveBSD. (Not updated to RC1 just yet, but it gives a nice idea of the progess made)"
MD5sum: MD5 (dfly-1.0RC1.iso.gz) = 663bc0ce4c077c4eeb38792e846210ea
Additionally, a torrent and list of mirrors are also available.
www.sitetronics.com/wordpress
Support for variant symbolic links is exciting. That makes it really easy to support 64/32-bit modes on Opteron systems. Similarly, it makes it easy to support variant ABIs for (e.g.) C++ runtime environments without encoding ABI versions into library names, but do look out for combinatorial explosion...
I think this project is a good model for how large projects should be handled.
They published their design and a roadmap for implementing their design. This
makes it easier for a lurker who is watching the project to actually jump in
and contribute to it.
At least, it seems that way in theory. Anyone have any idea how responsive the
community has been to this project?
*sigh* back to work...
Uh, anyone want to give an idiot like me a concise and clear reason why DragonFly BSD is superior to the other BSD variants? What specific applications is it more suited towards?
No, I'm not trolling, but thanks for asking.
Karma: Chevy Kavalierma.
I've been using it since february, and let me tell you, it's great! It's fast, and generally stable (between major changes, it is a prerelease OS don't forget!), and it runs legacy Linux and FreeBSD binaries at native speeds.
;^)
And it is being redesigned at it's core to be a clustering capable operating system (although this is not in just yet). Soon it will be able to run user mode drivers, greatly enhancing the stability of the system to levels that no other current OSS project can boast (and still be telling the truth
This truely is what a modern UNIX-like OS should be!
Way to go Matt and the rest of the DragonFly team!
Good news, everyone!
Turns out that *BSD is stronger than ever!
According to an Inernetnews article, Netcraft has confirmed that *BSD has "dramatically increased its market penetration over the last year."
There has been a steady increase in *BSD developers over the past decade.
You can read more about FreeBSD here
If you would like to try out a BSD, you can download: FreeBSD, OpenBSD, NetBSD, or DragonflyBSD
Enjoy!
W^X, ProPolice, randomized shared library loading. All of these happen to ANY program compiled from source, with or without code auditing, and make overflows pretty damn hard to exploit, probably impossible.
Linux doesn't do any of those, since it's just a kernel. Some distros might hack in something like PAX, but its nowhere near as pervasive and as well tested as on OpenBSD - it takes toolchain support for randomised shared libraries, and OpenBSD also fixed a lot of bugs in Propolice while integrating it, showing noone else has seriously tried it to use it before across multiple architectures.
Oh I didn't even mention stuff like StackGhost on sparc...
Linux does "W^X", aka non executable mappings in non-leet speak
/usr/libexec/ld.so /usr/lib/libtermcap.so.9.0 /usr/lib/libc.so.30.3 /usr/local/bin/bash /usr/libexec/ld.so /var/run/ld.so.hints
... except via PAX, although I'll be glad to be corrected. Of course, not many major distros actually use PAX or Propolice, where OpenBSD delivers tested binary packages for 10 (or whatever the current number is) different architectures. I'm not interested in security where I have to patch and recompile my entire OS.
No it doesn't. W^X ensures that there are no pages in a process's address space which are writable and executable and separates them. Not just a non-exec stack. For example on i386:
0250B000 24K read/exec
0280A000 4K read/exec [ uvm_aobj ]
06B04000 188K read/exec
0861F000 508K read/exec
1C000000 348K read/exec
2250B000 4K read
2250C000 4K read/write [ anon ]
(trim)
7EB90000 4K read/write [ anon ]
865FF000 12K read
CDBFE000 28672K [ stack ]
CF7FE000 4040K read/write [ stack ]
Notice how the exec mapping stop, and the write mapping begin. This means on i386 the segment registers can be used to enforce read/write/execute - you dont need a new processor with per-page NX (although that works as well of course).
It does randomized shared library loading, and this doesn't require toolchain support in Linux, probably because its design is cleaner than OpenBSD's
Vanilla Linux doesn't
Linux can quite easily be built with propolice, and it has a very fine security infrastructure with SELinux. More advanced than what OpenBSD has.
Very funny. The average sysadmin understands the UNIX security model. Not many understand the insanely complex SE Linux thing.
Linux does a lot of things better than OpenBSD, but really, security just isn't one of them. I always regret posting to Slashdot to try to correct some of the cluelessness here, so this will be my last post here for a while again.