OpenBSD 3.6 Live

An anonymous reader writes "There is a mounting excitement for the upcoming OpenBSD 3.6 release, as it is the first release that supports multiprocessor systems. To celebrate the event, ONLamp.com published an interview with several developers to discuss new features, tools, and future plans."

Comments

*BSD obviously not dead.

[NekkidBob]

There has been so much development in all the BSD's, and a new BSD system (DragonFlyBSD) coming out, how can anyone say *BSD is dead? The OpenBSD community has even pushed some vendors to release firmware for various hardware in a more open source way. If a "dead" community can convince hardware vendors to do that, then why isn't the Linux community doing more to make vendors release more firmware/docs in an open way.

Re:Damn

[NekkidBob]

Well if you have enough to spare one, I'm sure a developer could use a multiproc sun box, check their wanted hardware list about donating one to further smp for sun.

Apache on OpenBSD

[jpkunst]

Apache on OpenBSD always had a lot of security-related patches compared to the regular Apache (chroot for example), but it seems that Apache on OpenBSD can now be considered a real fork:

After the 1.3.29 they decided to muck with their license, introducing stupid patent terms without understanding what they turned their license (that used to be a BSD-derived one) into with that, so we cannot import new versions unless they fix their license. It is not a big loss tho'. The Apache people have mostly given up on 1.3 anyway, and all that happened over the last years was bug fixes, documention work (actually, mainly translation), and some stupid code shuffling, that only made diffs bigger without improving anything. Now that it is certain that we don't have to worry about syncing to them any more, we can start making the mess of code readable tho'.

JP

Re:Apache on OpenBSD

[jtharpla]

Indeed, they should rename it and continue to fork away, ala IPF->PF. Personally, though I know the roots were political, I have enjoyed the results. I prefer the OpenBSD-flavored Apache because of it's out-of-the-box chroot config. Somethings that would be nice to add in would be RedHat's default of having a directory of config files (easy enough to configure after the fact) and having a decent log rotation scheme. I ended up using VLogger, which is a nice Perl script that I found. Works well for hosting multiple sites.

What an Interview! Wireless firmware storm brewin

[Anonymous Coward]

I have never seen so much credible info from so many of the OpenBSD developers! I understand now a little more how they approach things. I wish I could read a similar article on the others, to see how FreeBSD and NetBSD and DragonflyBSD compare. Hopefully Oreilly will see the uptick in web hits and keep it up, with some more interview type articles.

There is a storm brewing over at the OpenBSD Journal web site at http://undeadly.org over including binary blob files in the kernel for the fariuos wireless cards. I have to agree with the premise: You vendors put your binary firmware files on all the CDs you sell with your wireless cardss, so if anyone wanted to reverse engineer yoru stuff, they just have to buy the card and they get the binary file. OpenBSD just wants to put same file in their distribution so if you plug your wireless card into an OpenBSD system it will get recognized and used. Sounds simple enough to me. The other approach is to somehow download the file (freely available on sourceforge or from the vendor, or the CD that came with your little card..) That makes it so much more involved for installing.

The short version: Some companies see the light and are cooperating, others, notably Texas Instruments http://www.ti.com have been strangely silent. Fasten your seat belts, fellow puffys.

On this note

[Anonymous Coward]

I never really understood why many commercial vendors are developing software for linux and not BSD.

An example would be Oracle. I was comparing Linux to OpenBSD and I can't really figure out why so many people choose Linux over OpenBSD. Both have package management, good software support, and standard *nix features. OpenBSD on the other hand has features no other unix has such as secure levels and it is secure out of the box.

Why would anyone select an OS (expecially for network infrastructure) that is not secure by default?

Re:On this note

[setagllib]

The other BSDs have security levels. OpenBSD has a lot of things they don't, still, a large part of which is that it randomizes practically everything, making it very difficult for even a local attacker to know what the kernel is going to do next. They also yank out any external software that isn't getting properly treated against exploits, so their base package is still as firm as possible, and even ports are treated with great care.

In practice, FreeBSD and NetBSD are about as hard to exploit remotely, but they don't take care of every possible exploit, so in theory there are still some holes. NetBSD is still a lot faster than OpenBSD (unless some miracle happened and I missed it) so a 'real world' server might benefit more, but for a stronghold of impenetrable security that doesn't need every last drop of performance, OpenBSD is the choice.

Linux is nowhere near any of this. The code is sloppy and dirty (no, nobody can argue this, don't even try, just go read some yourself) and few distributions actually take security seriously. It does happen to perform better in many synthetic tests, and definitely on SMP, but the difference for most cases is so minimal that it's hard to understand why anyone would run Linux on a server and not a BSD.

I put it down to hype. Business love to advertise their adoption of Linux and their entrance into open-source, because that's what customers want to hear, especially Linux zealots. The businesses (hell, even governments now) certainly aren't scientific about it, using an "operating system" (I still call Linux a kernel, up to you) mashed together from seemingly infinite and inconsistent projects and parents'-basement-developed hacks. The source shows this, hell even configuration shows this, but they seem to be okay with this so long as it sounds good. Or, and I wouldn't be surprised, they've never heard of BSD.

OpenBSD 3.6 released

[dhartmei]

The official release has just happened. Here are the official announcement, the undeadly.org thread and a torrent for the i386 binaries (149MB, matching MD5 which might beat some of the mirrors). Cheers ;)

Re:OpenBSD 3.6 released

[OttoM]

MD5 is still safe for the purpose of file digests. The methods published do not allow the attacker to find a collision for a given digest value. Check this FAQ for some details.

Props

[jazman_777]

OpenBSD showed me, security-wise, how crufty and cobbled Linux is. IPtables? Are you kidding? pf rolls it up and smokes it.

Re:Props

[setagllib]

iptables modelled after ipfilter? I had always been under the impression it was moddled out of clay.

No user->kernel facility interface should ever be that dirty, much less a packet filter. Sure, the way it handles NAT and everything in one relatively uniform way is kinda handy, but the syntax and rigidness is disgusting. You can have a range of ports, or a list of ports, but not a list of ranges of ports. Don't even think about logging and acting on a packet in the same rule. Just pathetic.

ipfw, pf, ipfilter, they're all so much cleaner and so much more useful. With OpenBSD's new rule optimizer this is even more awesome. I still think natd/ipnat/ would be better off merging their functionality into the filter itself, even if only to make dynamic NAT rules by shell script easier.

Re:binary updates

[evilviper]

Now do this on every OpenBSD,

Not the case. You only need to do the compile on one, and distribute the binaries to the rest of your machines.

Don't even get me started on release upgrades; ie. from 3.5 -> 3.6

Why not? It's trivially easy. Merging old config files with new ones is the only thing you need to do maually. Config files don't change often, so it can be skipped, with little chance anything you run will have a problem.

Not like any other OS has the upgrade path perfected. You sure as hell don't dare upgrade your Windows machines. I don't know anybody that upgrades their Linux machines, at least no more than installing a few RPMs of newer programs. It's generally best to start clean with Linux.

Re:"Linux" IS secure by default

[stab]

If I combine the core teams, even the security teams of all the flavors COMBINED, we'll have a hard time finding programmers with stable jobs, let alone an advanced degree in the area or an industrial lab support.

Are you serious? Here's a hint ... BSD has "Berkelely" in the name, and the university heritage lives on.

Re:"Linux" IS secure by default

[Anonymous Coward]

If I combine the core teams, even the security teams of all the flavors COMBINED, we'll have a hard time finding programmers with stable jobs, let alone an advanced degree in the area or an industrial lab support. I know I sound quite rude, but I am trying to illustrate my point. Just check out the bios.

I'm going to be brutally honest with you, and I hope that this advice helps you in the future: people who have sex with animals shouldn't point out other's foibles. That's not to say that you put peanutbutter on your dick and have the dog lick it off; it's just something that I think you should consider before posting. Because while people who have sex with animals (and I'm not saying that you do) aren't necessarily "bad" people, they tend to have warped perceptions, perhaps without even being aware of it. So, while I'm not saying that you like taking it up the ass from your cockerspaniel "Checkers," while jerking your meat to "she-male" anthropomorphic penguin pictures, I AM saying that you should consider these things, and your current state of affairs before posting, as you may (or may not) be unaware of your warped views.

In closing, I know that this may seem harsh, or rude, or even arousing to you right now, but I'm just trying to illustrate my point.