Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenBSD 3.6 Live

Posted by michael on from the keep-on-plugging dept.

An anonymous reader writes "There is a mounting excitement for the upcoming OpenBSD 3.6 release, as it is the first release that supports multiprocessor systems. To celebrate the event, ONLamp.com published an interview with several developers to discuss new features, tools, and future plans."

24 of 86 comments (clear)

  1. *BSD obviously not dead. by NekkidBob · · Score: 4, Insightful

    There has been so much development in all the BSD's, and a new BSD system (DragonFlyBSD) coming out, how can anyone say *BSD is dead? The OpenBSD community has even pushed some vendors to release firmware for various hardware in a more open source way. If a "dead" community can convince hardware vendors to do that, then why isn't the Linux community doing more to make vendors release more firmware/docs in an open way.

  2. Damn by armypuke · · Score: 2, Insightful
    SMP support on OpenBSD/i386 and OpenBSD/amd64 platforms.
    I was getting my hopes up that I could finally run OpenBSD on a couple of multiprocessor Sun boxes that I have.

    Damn

    --
    Army of One!
    1. Re:Damn by NekkidBob · · Score: 5, Informative

      Well if you have enough to spare one, I'm sure a developer could use a multiproc sun box, check their wanted hardware list about donating one to further smp for sun.

  3. Apache on OpenBSD by jpkunst · · Score: 5, Informative

    Apache on OpenBSD always had a lot of security-related patches compared to the regular Apache (chroot for example), but it seems that Apache on OpenBSD can now be considered a real fork:

    After the 1.3.29 they decided to muck with their license, introducing stupid patent terms without understanding what they turned their license (that used to be a BSD-derived one) into with that, so we cannot import new versions unless they fix their license. It is not a big loss tho'. The Apache people have mostly given up on 1.3 anyway, and all that happened over the last years was bug fixes, documention work (actually, mainly translation), and some stupid code shuffling, that only made diffs bigger without improving anything. Now that it is certain that we don't have to worry about syncing to them any more, we can start making the mess of code readable tho'.

    JP

    1. Re:Apache on OpenBSD by jtharpla · · Score: 3, Informative

      Indeed, they should rename it and continue to fork away, ala IPF->PF. Personally, though I know the roots were political, I have enjoyed the results. I prefer the OpenBSD-flavored Apache because of it's out-of-the-box chroot config. Somethings that would be nice to add in would be RedHat's default of having a directory of config files (easy enough to configure after the fact) and having a decent log rotation scheme. I ended up using VLogger, which is a nice Perl script that I found. Works well for hosting multiple sites.

  4. At least he's honest by cmad_x · · Score: 2, Interesting
    FB: How does this compare with FreeBSD 4, FreeBSD 5, and DragonFlyBSD? Niklas Hallqvist: Actually I don't know. I'd expect we'd do worse in anything that is interrupt-intensive. We probably do worse even for the common case where several runnable processes exist simultaneously as well. But ... we do not aim to compete at the edge here. We want to make scalability happen without disrupting our security and robustness track record. We just have other priorities.
    Well at least he's being honest, unlike *cough* other people/companies. Go OpenBSD security!
  5. What an Interview! Wireless firmware storm brewin by Anonymous Coward · · Score: 4, Interesting

    I have never seen so much credible info from so many of the OpenBSD developers! I understand now a little more how they approach things. I wish I could read a similar article on the others, to see how FreeBSD and NetBSD and DragonflyBSD compare. Hopefully Oreilly will see the uptick in web hits and keep it up, with some more interview type articles.

    There is a storm brewing over at the OpenBSD Journal web site at http://undeadly.org over including binary blob files in the kernel for the fariuos wireless cards. I have to agree with the premise: You vendors put your binary firmware files on all the CDs you sell with your wireless cardss, so if anyone wanted to reverse engineer yoru stuff, they just have to buy the card and they get the binary file. OpenBSD just wants to put same file in their distribution so if you plug your wireless card into an OpenBSD system it will get recognized and used. Sounds simple enough to me. The other approach is to somehow download the file (freely available on sourceforge or from the vendor, or the CD that came with your little card..) That makes it so much more involved for installing.

    The short version: Some companies see the light and are cooperating, others, notably Texas Instruments http://www.ti.com have been strangely silent. Fasten your seat belts, fellow puffys.

  6. On this note by Anonymous Coward · · Score: 3, Insightful

    I never really understood why many commercial vendors are developing software for linux and not BSD.

    An example would be Oracle. I was comparing Linux to OpenBSD and I can't really figure out why so many people choose Linux over OpenBSD. Both have package management, good software support, and standard *nix features. OpenBSD on the other hand has features no other unix has such as secure levels and it is secure out of the box.

    Why would anyone select an OS (expecially for network infrastructure) that is not secure by default?

    1. Re:On this note by setagllib · · Score: 4, Informative

      The other BSDs have security levels. OpenBSD has a lot of things they don't, still, a large part of which is that it randomizes practically everything, making it very difficult for even a local attacker to know what the kernel is going to do next. They also yank out any external software that isn't getting properly treated against exploits, so their base package is still as firm as possible, and even ports are treated with great care.

      In practice, FreeBSD and NetBSD are about as hard to exploit remotely, but they don't take care of every possible exploit, so in theory there are still some holes. NetBSD is still a lot faster than OpenBSD (unless some miracle happened and I missed it) so a 'real world' server might benefit more, but for a stronghold of impenetrable security that doesn't need every last drop of performance, OpenBSD is the choice.

      Linux is nowhere near any of this. The code is sloppy and dirty (no, nobody can argue this, don't even try, just go read some yourself) and few distributions actually take security seriously. It does happen to perform better in many synthetic tests, and definitely on SMP, but the difference for most cases is so minimal that it's hard to understand why anyone would run Linux on a server and not a BSD.

      I put it down to hype. Business love to advertise their adoption of Linux and their entrance into open-source, because that's what customers want to hear, especially Linux zealots. The businesses (hell, even governments now) certainly aren't scientific about it, using an "operating system" (I still call Linux a kernel, up to you) mashed together from seemingly infinite and inconsistent projects and parents'-basement-developed hacks. The source shows this, hell even configuration shows this, but they seem to be okay with this so long as it sounds good. Or, and I wouldn't be surprised, they've never heard of BSD.

      --
      Sam ty sig.
    2. Re:On this note by Anonymous Coward · · Score: 2, Funny
      I never really understood why many commercial vendors are developing software for linux and not BSD.


      Why are so many commercial vendors developing software for Windows and not RSX-11???!?!???!?!??!!!?!? Someone answer meeeeeee!
  7. OpenBSD 3.6 released by dhartmei · · Score: 5, Informative

    The official release has just happened. Here are the official announcement, the undeadly.org thread and a torrent for the i386 binaries (149MB, matching MD5 which might beat some of the mirrors). Cheers ;)

    1. Re:OpenBSD 3.6 released by tedu · · Score: 2, Informative
      it would still have to pass the zlib crc in order to decompress. and then the attacker has to hope whatever esoteric changes they made are actually useful to them.

      anyway, where are you getting the md5 from? the same ftp server where you're getting the release?

    2. Re:OpenBSD 3.6 released by OttoM · · Score: 3, Informative

      MD5 is still safe for the purpose of file digests. The methods published do not allow the attacker to find a collision for a given digest value. Check this FAQ for some details.

    3. Re:OpenBSD 3.6 released by evilviper · · Score: 2, Interesting
      anyway, where are you getting the md5 from? the same ftp server where you're getting the release?

      Well, an MD5 is very small, and could easily be checked. If I was running the OpenBSD project, I'd have a machine with all the correct hashes, downloading the hash files from each server ever hour, and rasing hell if they're different. That would take care of the problem, if only the people running the project even cared.
      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
  8. Upgrade Pain by Anonymous Coward · · Score: 2, Insightful

    Is there an easier way to upgrade to 3.6 from 3.5 without removing all the packages?
    I have a fairly amount of packages, but I would also want minimum downtime for the upgrade. Maybe a make world make install mergemaster (reboot) would work better. Any ideas?

    How stable is the SMP stuff?

  9. Props by jazman_777 · · Score: 5, Insightful

    OpenBSD showed me, security-wise, how crufty and cobbled Linux is. IPtables? Are you kidding? pf rolls it up and smokes it.

    --
    Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
    1. Re:Props by Ricin · · Score: 2, Interesting

      And pf was of course modeled after Darren Reed's ipfilter which was OBSD's package filter software in the past (until there was some disagreement), and NetBSD's (still now) and optionally FreeBSD's (one of two, now three).

      In fact I think iptables was somewhat modeled after ipflter. There has been an ipfilter port for RedHat around RH5 IIRC but it got abandoned.

    2. Re:Props by setagllib · · Score: 5, Insightful

      iptables modelled after ipfilter? I had always been under the impression it was moddled out of clay.

      No user->kernel facility interface should ever be that dirty, much less a packet filter. Sure, the way it handles NAT and everything in one relatively uniform way is kinda handy, but the syntax and rigidness is disgusting. You can have a range of ports, or a list of ports, but not a list of ranges of ports. Don't even think about logging and acting on a packet in the same rule. Just pathetic.

      ipfw, pf, ipfilter, they're all so much cleaner and so much more useful. With OpenBSD's new rule optimizer this is even more awesome. I still think natd/ipnat/ would be better off merging their functionality into the filter itself, even if only to make dynamic NAT rules by shell script easier.

      --
      Sam ty sig.
  10. Re:openbsd is so slow by setagllib · · Score: 2, Interesting

    That wasn't actually a reply to what I said at all, but I agree with you anyway, NetBSD is the one for miling performance out of machines and software. I find it usually leaves Linux in the dust too, but I haven't tried SMP.

    --
    Sam ty sig.
  11. Re:binary updates by evilviper · · Score: 3, Informative
    Now do this on every OpenBSD,

    Not the case. You only need to do the compile on one, and distribute the binaries to the rest of your machines.

    Don't even get me started on release upgrades; ie. from 3.5 -> 3.6

    Why not? It's trivially easy. Merging old config files with new ones is the only thing you need to do maually. Config files don't change often, so it can be skipped, with little chance anything you run will have a problem.

    Not like any other OS has the upgrade path perfected. You sure as hell don't dare upgrade your Windows machines. I don't know anybody that upgrades their Linux machines, at least no more than installing a few RPMs of newer programs. It's generally best to start clean with Linux.

    --
    Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
  12. Re:binary updates by rsax · · Score: 2, Informative
    Not the case. You only need to do the compile on one, and distribute the binaries to the rest of your machines.

    I'm assuming you're referring to the release(8) procedure which will generate base35.tgz, etc35.tgz, comp35.tgz, misc35.tgz, man35.tgz etc.

    Now how large is base35.tgz? Approximately 30 megs? It doesn't make sense to transfer 30 meg updates to numerous machines to apply an update for just a couple of files that could have been 1 or 2 megs if smaller binary updates were available. Well atleast it doesn't to me anyway. I guess beggars can't be choosers. Although right now I primarily use FreeBSD so it doesn't have the simple .tgz archives.

    DISCLAIMER: I'm not a developer

    I read this comment in a mailing list. Wouldn't it be awesome if /usr/src tree would be structured in a way that /usr/ports is right now? So you could apply that radius source patch to your /usr/src tree and then

    # cd /usr/src/net/radius
    # make package clean

    Resulting in radius_version.tgz which could easily be installed using existing pkg_* tools.

  13. Re:"Linux" IS secure by default by tedu · · Score: 2, Informative
    There's way more freedom and more room for innovation in the Linux camp than working under the orders of Theo or the $18,000/year software programmer in the core team of the average BSD distro.

    that statement demonstrates a complete lack of understanding about how openbsd, or any bsd, are developed, or even who is developing them.

  14. Re:"Linux" IS secure by default by stab · · Score: 3, Informative

    If I combine the core teams, even the security teams of all the flavors COMBINED, we'll have a hard time finding programmers with stable jobs, let alone an advanced degree in the area or an industrial lab support.

    Are you serious? Here's a hint ... BSD has "Berkelely" in the name, and the university heritage lives on.

  15. Re:"Linux" IS secure by default by Anonymous Coward · · Score: 4, Funny

    If I combine the core teams, even the security teams of all the flavors COMBINED, we'll have a hard time finding programmers with stable jobs, let alone an advanced degree in the area or an industrial lab support. I know I sound quite rude, but I am trying to illustrate my point. Just check out the bios.

    I'm going to be brutally honest with you, and I hope that this advice helps you in the future: people who have sex with animals shouldn't point out other's foibles. That's not to say that you put peanutbutter on your dick and have the dog lick it off; it's just something that I think you should consider before posting. Because while people who have sex with animals (and I'm not saying that you do) aren't necessarily "bad" people, they tend to have warped perceptions, perhaps without even being aware of it. So, while I'm not saying that you like taking it up the ass from your cockerspaniel "Checkers," while jerking your meat to "she-male" anthropomorphic penguin pictures, I AM saying that you should consider these things, and your current state of affairs before posting, as you may (or may not) be unaware of your warped views.

    In closing, I know that this may seem harsh, or rude, or even arousing to you right now, but I'm just trying to illustrate my point.