New BSD licensed CVS replacement for OpenBSD

Jeferey Bakins writes "In an effort, by Jean-Francois Brousseau (jfb@openbsd.org), to rid the OpenBSD CVS tree of GPL'ed licensed code, OpenCVS is now officially part of the OpenBSD project. For more details, see the OpenCVS homepage; http://www.openbsd.org/opencvs/"

Comments

Why ?

[noselasd]

While I can understand their desire for a BDS license version of CVS.
why the heck did they not rather write a CVS replacement/improved
the CVS braindamage while they were at it ?

Re:Why ?

[Anonymous Coward]

One step at a time. Their use of CVS is deeply ingrained at the moment. Rewriting a well-understood tool is one thing. Designing and implementing a new source-control tool is a much larger, riskier task.

Re:Why ?

[Anonymous Coward]

Read again...

While CVS have been a functional tool in simple use, it has quite some drawbacks. Everyone who has been in the CVS guts (believe me, I have), knows that it is essentially write-only code.
It is quite buggy, albeit the bugs are in corner-cases, not seldom noticed by people not using CVS massively. The CVS maintainers have been unwilling to accept bug reports (it may be a matter of opinion: "it's not a bug, it's a feature" has been heard). OpenBSD have had several local changes to cvs over the years.
However, for the reason stated above (write-only code), we cannot trust the code enough. It has been one of the weakest spots of our system securitywise. CVS is also a network service, as such, it can put systems into potential risk, like
all network services. We want to be able to put greater trust into this service. The people who thinks this is just license masturbation are wrong. It is nice to be able to free code, but the important thing is to secure it. GCC is not a network service. The GPL is not reason enough for us (yet .-) ) to rewrite it. Also, understandable code makes it easier to find a fix non-security bugs (but we like to look at all bugs, as potentially exploitable ones .-)).

Niklas Hallqvist (I don't care enough to create a /. account)...

Re:Why ?

[M1FCJ]

Subversion guys just did that and it is good. It is riskier, they are still coding but it is already very good indeed.

Re:Why ?

[aled]

They are still coding because they are actively adding features and correcting bugs, unlike CVS.

Re:Why ?

[Anonymous Coward]

thank you.
people in here tend to be License Nazis

Re:Why ?

[Anonymous Coward]

subversion is under the apache2 license and thus not free.

That's great. . . but, um, why?

[Christopher Cashell]

I'm all for developers choosing their own license, and I'll for making sure that license incompatibilities don't cause problems for software developers.

However, we're talking about a tool you use for development, not something that is traditionally integrated into an application. CVS is a solid piece of software, and Subversion fixes many of the minor issues with CVS, and if those aren't your cup of tea, there are a number of other interesting version management tools (darcs, arch, bitkeeper, etc).

Considering all of that, do we really need a CVS clone, where the only difference is the license?

Especially when development of CVS has essentially ceased, other than bug/security fixes, and there are superior alternatives being developed (even the CVS developers will readily admit that CVS has architectural deficiencies that can really only be solved by a design, which is why most of them have moved on to other versioning tools).

So, I'm left wondering. . . why? Why bother doing this? What exactly does this achieve? I mean, if the guy writing this gets his rocks off on reimplementing somewhat obsolete applications, then more power to him, but I can't help but think that he could find something more rewarding than this.

Re:That's great. . . but, um, why?

[DrSkwid]

do we really need a CVS clone, where the only difference is the license?

When the "we" is OpenBSD then the answer is yes.

If you are not part of that "we" then the question is pointless.

Re:That's great. . . but, um, why?

[Christopher Cashell]

When the "we" is OpenBSD then the answer is yes.

So the goal is to reimplement every piece of GPLed code, is that correct?

Let me know when they've finished with their GCC, Gnome, and KDE replacements. I'm looking forward to trying them out in 2012.

If you are not part of that "we" then the question is pointless.

Ah, that's helpful. All of a sudden, I'm reminded of why I've never cared much for OpenBSD.

You guys enjoy your "new" CVS. I'm going back to actually getting work done using the tools available to me, including new technology like Subversion, darcs, and arch, as well as legacy software like CVS.

Ideology is great, but once I reach the minimum required level of freedom (for my definition of free (which tends to closely parallel the DFSG)), I'm more interested in pragmatism and getting things done.

Re:That's great. . . but, um, why?

[Anonymous Coward]

For some people, the old Soviet Union met their minimum required level of freedom.
Make your own choices and live with them instead of carping at others in matters that clearly do not concern you.

Re:That's great. . . but, um, why?

[SillyNickName4me]

> know a lot of folks prefer the BSD license and I respect that but does the desire to support the proprietary software industry really mean that all GPL'd code needs to be ported? That's silly. Cycles are being wasted just so that some jack-ass can come along and close your work up again. BSDers may see that as some kind of freedom but pretty much everyone else sees that as inane.

You really know how to show soem respect do you?

I know it is a lto to ask, but would you at least bother to actually read the opencvs homepagge? you may find there is more to it then a licensing issue.

Ah well, why bother indeed, it is more fun to just skip the article and post some stupid anti bsd license nonsense.

Re:That's great. . . but, um, why?

[xoboots]

> I know it is a lto to ask, but would you at least bother to actually read the opencvs homepagge? you may find there is more to it then a licensing issue.

If it wasn't just a license thing, then why not just patch CVS? Why not fork CVS and use the same license? Why not contribute to a project that offers superior services to CVS (say DARCS or the like)? No, it is foremost a licensing issue and you are being disengenious saying otherwise. You may call me impolite if you wish, but I am no more impolite as the insinuation that GPL'd CVS is somehow not FREE.

Re:That's great. . . but, um, why?

[Anonymous Coward]

Ahem... cvs is a network service, gnome/kde are just desktop environments. OpenBSD is focussed on securing networks, yes? What makes you think that writting a more secure cvs is a waste of time? You talk about being pragmatic, but then you say everybody needs to start using subversion/darcs, so you must also think everyobody must ditch Windows OS and use Linux instead? Well guess what, people are going to keep using the tools they already know and have invested much time in, so maybe it's good if somebody can fix these tools.

Re:That's great. . . but, um, why?

[SillyNickName4me]

> No, it is foremost a licensing issue and you are being disengenious saying otherwise.

It is also a licensing issue.

> You may call me impolite if you wish, but I am no more impolite as the insinuation that GPL'd CVS is somehow not FREE.

It has a restriction. That restriction may serve a good purpose, but it is a restriction nonetheless and hence less free. If it is free enough or actually better or whatever is a matter of opinion. Calling it non free is a bit too much imho, but calling it not free enough, well, I tend to agree there, but I accept that others don't. How difficult is it for you to do what you said and accept someoen elses choice, even more when that someone is also prepared to do the work for it?

Re:That's great. . . but, um, why?

[Anonymous Coward]

If it wasn't just a license thing, then why not just patch CVS? Why not fork CVS and use the same license? Why not contribute to a project that offers superior services to CVS (say DARCS or the like)? No, it is foremost a licensing issue and you are being disengenious saying otherwise.

Erh, patching old, crufty, buggy CVS code may not be the best way to make it secure. OpenBSD realize that making CVS as secure as they prefer would imply a rewrite in any case. So why not start out fresh? Much easier to audit their own code based upon their own secure coding techniques.

Re:That's great. . . but, um, why?

[Anonymous Coward]

You didn't write the code, so shut yer yap. It's amazing how people who are "pro-freedom" want so much to control the actions of others.
Oh yes, true freedom means you don't try to control others. That means you, and the GPL are not about freedom, they're about imposing your will on others.

Re:That's great. . . but, um, why?

[Goo.cc]

You know, some people don't care for software that is emcumbered by the GPL and it is perfectly reasonable to write a replacement for such software. Just because you don't agree doesn't make it wrong.

Re:That's great. . . but, um, why?

[Richard_at_work]

The thing that amuses me about this post is that someone probably said this exact thing way back in the 1980s when GNU put together the project to write their own c compiler, unix replacement etc. When will people understand that some people view the GPL in the same manner as those GPL evangelists view commercial licenses - not free enough. Ideology is great, but you have to realise that everyones ideological views are the same - an opinion, and yours may not be the same as mine.

Re:That's great. . . but, um, why?

[xoboots]

> It has a restriction. That restriction may serve a good purpose, but it is a restriction nonetheless and hence less free. If it is free enough or actually better or whatever is a matter of opinion. Calling it non free is a bit too much imho, but calling it not free enough, well, I tend to agree there, but I accept that others don't.

Sometimes I wonder at the unsophistication of ideas that exist when it comes to freedom. After all, many minds have wrestled with this over the centuries. Kant seemed to sum it up best but even he came short of a full and final explanation. The short version is that we should all be free enough to do as we will so long as it does not impede the freedom of others to do the same. That's the rub, of course, and it is the very thing that the GPL tries to address. Kant tried to rationalize that need by suggesting that there are essential ethical considerations that were apriori true. Considering the disgareement over these apriori truths, he was seemingly wrong, but he was hitting a nerve since it turns out that every colelctive of individuals tend towards shared value systems (whether political, economic, religious, etc). The issue is defining these value systems but they are there. Sartre furthered the discussion by showing that with freedom is the requisite of responsibility, that the two are part of a single continuum. So we can't avoid the eticial issues if we truly want freedom. I Challenge anyone to name any collective endeaver where this is not true. Free Market System? Hardly--it is one of the most regulated environs around. Free Social system? Har har. Free anything? Its a delusion to think you can have people do what they will without restrictions of any sort. That isn't anarchy (which, as a self-organizing behaviour *must* have internal rules and thus restrictions) but rather despotism.

> How difficult is it for you to do what you said and accept someoen elses choice, even more when that someone is also prepared to do the work for
it?

Not at all--I have no intention of ever trying to STOP anyone from doing what they will, but is it too much to allow me to express my opinion on the matter? Is that not a freedom that I am entitled to have?

Re:That's great. . . but, um, why?

[SillyNickName4me]

> Sometimes I wonder at the unsophistication of ideas that exist when it comes to freedom. After all, many minds have wrestled with this over the centuries. Kant seemed to sum it up best...

As said, you can argue all you want, it is still less freedom.

Besides, the GPL restriction does not limit your freedom such that it doesn't impede on that of others. It protects your work from being distributed under any other license then the gpl (unless you decide to do so yourself) which impedes on the freedom of others (and yes, I think it is a perfectly valid limitation also, but that is entirely ebsides the point)

> Not at all--I have no intention of ever trying to STOP anyone from doing what they will, but is it too much to allow me to express my opinion on the matter? Is that not a freedom that I am entitled to have?

It is a freedom that you have, just as I have the freedom to point out that you first talk about respecting a choice and then show very little respect.

Re:That's great. . . but, um, why?

[DrSkwid]

if you're not part of the "we" then tbh. you have no point talking at all.

It is not a debate.

Re:That's great. . . but, um, why?

[Anonymous Coward]

So the goal is to reimplement every piece of GPLed code, is that correct?

no

Let me know when they've finished with their GCC, Gnome, and KDE replacements. I'm looking forward to trying them out in 2012.

right, because gnome and kde are so vitally important to our system development that we must make it a priority to rewrite them.

You guys enjoy your "new" CVS. I'm going back to actually getting work done using the tools available to me, including new technology like Subversion, darcs, and arch, as well as legacy software like CVS.

you probably said the same thing when openssh was first released.

Re:That's great. . . but, um, why?

[Anonymous Coward]

the license is not the only difference.

Re:That's great. . . but, um, why?

[xoboots]

> if you're not part of the "we" then tbh. you have no point talking at all.

I love that version of freedom you are promoting! Anyone is invited as long as they stfu!

Sorry guy, but when an article appears on slashdot I have every right to comment. You don't own the stories, you know.

Re:That's great. . . but, um, why?

[archen]

Let me know when they've finished with their GCC, Gnome, and KDE replacements. I'm looking forward to trying them out in 2012.

Judging by this commment I'm guessing you haven't used any BSD variant. The idea isn't to reimplement EVERY piece of GPLed code, only the stuff in the BASE SYSTEM. It's hard for many Linux users to make that distinction, but in BSD you have the base operating system (that's more than the kernel) and the add on software.

Would you be happy using Linux if it had random things that had proprietary licences in it? Of course not. By the same token BSD is about being free via the BSD licence, it's really a snag when you have a mix of tools using BSD and GPL licences.

I don't see stuff like GCC going away, but GCC isn't neccesary for a functioning system so it can be torn out if someone doesn't need it. Most of the base system has GNU utilities in odd spots (tar was recently replaced in FreeBSD for instance). When all of this is said and done you know that the base system is BSD, and the rest of the software is whatever you stack on top of it - no confusion as to what is where.

Re:That's great. . . but, um, why?

[eneville]

Well, it's about time you heard the 3.6 MP3, I think its in ftp.openbsd.org/pub/songs/.

You may also want to read the lyrics.

Re:That's great. . . but, um, why?

[M1FCJ]

License differences are mainly political. Just like there is not a single "Truth", there is not a single political view. Every single person prefers a particular flavour of license, party. Why can't people just accept this as a fact of life and let people choose the license they would like to follow?

Re:That's great. . . but, um, why?

[M1FCJ]

Please pay $0.05 to read the rest of the comment.

Re:That's great. . . but, um, why?

[flynn_nrg]

CVS is a solid piece of software

No, it isn't. Development is not that active anymore, the code is a total mess. Why? The networking portions are an afterthought, so there's a lot of duplicated code. It has tons of problems (ever tried renaming a file and keeping its history?). But it does the job, that's why a lot of people use it. The OpenBSD guys rely on CVS to do their job, but if it's an insecure piece of software then a replace is very welcomed.

While I advocate OS, I settled on Perforce (free for 2 users/2 workspaces) for my home projects more than 2 years ago and never looked back.

I say, kudos OpenBSD guys for doing this, it's a win-win situation.

Re:That's great. . . but, um, why?

[jackmama]

Cycles are being wasted just so that some jack-ass can come along and close your work up again.

Of course, no one can close code that has been released with a BSD license. That person IS free to release their own closed version, or something else that incorporates the original code, but the copyright remains intact and the original codebase is not affected. This is the point of the BSD license -- free, unencumbered access to the source code while preserving copyright.

In contrast, the GPL grants full access to source, so long as all changes are released in turn. That's a noble cause, but it is imposing restrictions that the BSD license does not.

Re:That's great. . . but, um, why?

[xoboots]

I don't know why I bother to keep on replying, but...

> In contrast, the GPL grants full access to source, so long as all changes are released in turn. That's a noble cause, but it is imposing restrictions that the BSD license does not.

It is not noble--it is practical and it is the basis of the share-and-share-alike principle. Moreso than a restriction, it is a stipulation. That is, while it acts as a restriction, it is imposed as a means to ensure the share-alike-philosophy (and it is assumed that that is all required to ensure such). The problem with calling it "less free" as some are doing is that it all depends on how you measure freedom. If you look at the collective (and include future participants) I claim that the GPL is more free since it ensures that all versions are accessible and not just those that some are willing to share. To me, it seems that the only gaurantee that the BSD license ensures is that those who wish to release closed-source versions of the source can--how that benefits the community is beyond me. I don't want to argue (again) with the BSDers on this point--you folks are entitled to your choices. My original post was predicated on the fact that the OpenCVS page insinuated something about the GPL that was contrary to fact (that it was not FREE).

Greetings and best of luck.

Re:That's great. . . but, um, why?

[BollocksToThis]

However, we're talking about a tool you use for development, not something that is traditionally integrated into an application.

I think the key word in your comment is traditionally. OpenBSD want a system that can be given to anyone and everyone and let them use it or build on it how they will. I realise it's not the Unix way to embed CVS in your app when you could just make a system call to the existing binary, but someone may come up with an idea that takes it beyond the uses you (or I, or the OpenBSD team) see for it, and need to integrate some or all of that code into something else (for example, the file system). They can't do that without restriction if CVS is still under the GPL.

Re:That's great. . . but, um, why?

[setagllib]

Well the BSD license still is the 'freest' of the popular open source licenses, in that it only prevents people removing the copyright notice and basic clauses. Besides that, code can be integrated into any project, commercial or otherwise.

Many GNU evangelists think that this means BSDs "help" commercial software and hence are sabotaging OSS ideaology, but in reality commercial software will always be around, and if it's based on secure, trusted and matured code bases rather than hack-jobs they have to write from scratch, chances are commercial software will be good. From a security standpoint, less compromised machines out there mean less pollution and less chance of distributed DoS/brute force against any system.

OpenBSD in this regard is a very heavy contributor, providing a breeding ground for quality software that others see fit to use. Since it's all BSD, anyone can use it how they want. Think where we'd be today without OpenSSH, for instance.

Re:That's great. . . but, um, why?

[aled]

"those who wish to release closed-source versions of the source can--how that benefits the community is beyond me."

grandparent post points that the BSD licence is "freer" than GPL, that has nothing to do with helping the community, which may be a noble cause but it's a different thing.

Re:That's great. . . but, um, why?

[Brandybuck]

do we really need a CVS clone, where the only difference is the license?

If you would have bothered to read the article, instead of relying and the biased slashdot blurb, you would have realized that licensing isn't even offered as a reason. Really it's not!

For your edification, here is the complete stated rational for OpenCVS: "The OpenCVS project was started after discussions regarding the latest GNU CVS vulnerabilities that came out. Although CVS is widely used, its development has been mostly stagnant in the last years and many security issues have popped up, both in the implementation and in the mechanisms."

Re:That's great. . . but, um, why?

[mvdw]

So, remind me again where CVS fits in to this "base system". And then you can let me know why they take exception to CVS's license, but not GCC's license...

Re:That's great. . . but, um, why?

[mvdw]

Foget I wrote the above. Looking at the other comments, it seems I am wrong on a number of fronts...

Re:That's great. . . but, um, why?

[Anonymous Coward]

"So the goal is to reimplement every piece of GPLed code, is that correct?"

No.

The goal is to remove ALL GPL'ed code from the OpenBSD system; KDE nor GNOME is part of that system.

Re:That's great. . . but, um, why?

[Anonymous Coward]

NEOcommunists can't seem to grasp the idea of TRULY free software. IT may be politcal but the GPL is in many ways just as bad as a closed one

blog.evogts.com

Re:That's great. . . but, um, why?

[Anonymous Coward]

thats not for the /. crowd

Re:That's great. . . but, um, why?

[xoboots]

This is a troll? Yet the parent isn't? Bad moderator - no doughnut.

Re:That's great. . . but, um, why?

[Anonymous Coward]

Actually, some of the same argumments used for replacing CVS could apply to replacing GCC. System builds are both dependent on them, and they both have a less free (their argument) license.

difference being, GCC is perhaps more readable, and the maintainers are receptive to bug reports. I'm not an OpenBSD developer, but I'm sure if it was possible/practical to replace GCC (for the OS build reasons alone), I'm sure they'd do it.

The battle continues...

[__aafkqj3628]

Continuing to fuel the fanatical debate that "my software is more free than yours."

I guess whatever infection the GPL spread onto Linux users to turn them into GPL-evangelists has mutated, and is now infecting other licences.

Re:The battle continues...

[DrSkwid]

It is not a debate.

"do what thou wilt" is the OpenBSD creed and the GPL is incompatible with that, what's your problem ?

Re:The battle continues...

[__aafkqj3628]

The problem is that it turns into a debate, a pointless debate.

Re:The battle continues...

[ObsessiveMathsFreak]

There's no silver bullet for licences either. The OpenBSDers want their system licenced under their rules, and more power to them. They have to remove all GPL code to do this beacuse the GPL is a more or less all or nothing free software licence.
It's got nothing to do with evangelism, and all to do with practicality. You can't have bits and pieces of code GPLed and some not.

Other licences are more flexible, but are less precise. I'll still be using the GPL for most of the code I write, because I want as many people as possible to use it, and be fully secure in doing so.

Re:The battle continues...

[SirGeek]

There's no silver bullet for licences either. The OpenBSDers want their system licenced under their rules, and more power to them. They have to remove all GPL code to do this beacuse the GPL is a more or less all or nothing free software licence.

Then is Open BSD going to stop using GCC ? I mean, GCC is GPL so it is using GPL software to create their system, right ?

Re:The battle continues...

[Christopher Cashell]

It's got nothing to do with evangelism, and all to do with practicality. You can't have bits and pieces of code GPLed and some not.

That's not exactly true. . . you can't necessarily mix licenses within a single piece of software, but you can definitely do so within a larger software distribution.

The OpenBSD rewrite of CVS seems to serve no real purpose in my mind, because CVS is a tool that you use for managing your code, not something that is generally directly integrated into a larger application. As such, using it has no affect at all on the license of the code your managing with it.

If it makes them happy to do this, then hey, it's their time they're waisting, but as I see it, it's still a waste of time. ;-)

Re:The battle continues...

[Anonymous Coward]

OpenBSD wont stop using GCC until a reliable BSD licensed Compiler Collection replacement is available. One such possibility is TenDRA; http://www.tendra.org/

Correct; OpenBSD is compiled by the GCC.

Re:The battle continues...

[JDizzy]

Turns into a debate?

I'm sorry but for you maybe. For me watching you, it turns into a comedy.

Re:The battle continues...

[M1FCJ]

Now it is more corporate-friendly. If you want to make money out of it by modifying it, it is easier. You can just create an other bespoke platform, system, architecture.

It makes sense for many people, most of the people out there are not comfortable with "giving back to the community". The BSD license is the most free license in any way, it allows you to do whatever you want to. GPL is more restrictive but in the long run more beneficial to the masses.

Things I'm thinking about: A CVS-based system (in the background) where images, movies are stored, revisioned. I know quite a lot of people who would pay big bucks for this. I know a couple of companies who sell this kind of software pretty happily.

This is a free-software issue, anyone can do anything they like, as long as they stick to the license. Now there is a CVS-variant which is completely BSD. It sounds good to me, it is still not closed-source.

Re:The battle continues...

[Christopher Cashell]

From what I understand of CVS, adding the features you mention would require such a huge overhaul of the backend, and likely the repository format, that you'd be better off simply starting over with a new versioning system.

I guess that's the part that I really don't understand. . . CVS has many architecture limitations and now that we have superior replacements, it seems like an odd choice to deliberately step backwards to reimplementing CVs.

Re:The battle continues...

[Richard_at_work]

OpenBSD will stop using GCC when the Tendra Project has reached a satisfactory level of maturity. The OpenBSD team work under the premise that GPLed items are 'free enough for them' until a replacement can be found, just like Linus works under the same premise (see Bitkeeper).

Re:The battle continues...

[Anonymous Coward]

Tendra, huh?

"apt-get install tendra"

Woohoo. Gotta love Ubuntu.

Re:The battle continues...

[Ded Bob]

TenDRA is pretty good. Two different versions: http://www.ten15.org/ and http://www.tendra.org/

Re:The battle continues...

[Anonymous Coward]

"apt-get install tendra"

Woohoo. Gotta love Ubuntu.

For it to be used in OpenBSD, it needs to support the 12+ architechures that OpenBSD runs on; it needs to be at least as fast as GCC3, and produce code that is at least as efficient. Most importantly, there has to be significant evidence that the code it produces is correct.

None of these requirements have yet been met.

Re:The battle continues...

[evilviper]

Then is Open BSD going to stop using GCC ?

Eventually, yes.

With the generally crappiness of GCC3, quite a few developers have been looking at Tendra. Licensing issues helped, but it's really how slow and buggy GCC3 has become that is driving people away.

And before I get modded down as a pro-BSD troll, I'd like to say, you can hear the same complaints from plenty of Linux devs as well.

Re:The battle continues...

[M1FCJ]

SVN is a complete rewrite but at the moment the core developers are busy developing (IMHO) unnecessary features just to make CVS users happy. They implemented file server back end recently, now they are very busy rewriting code to implement locking. The first feature is throwing away the best thing SVN had: A database backend. The second feature is throwing the best method cycle SVN had: checkout-merge cycle.

IMHO, just to win over CVS users, they are wasting their time.

As it is clearly apparent, improving CVS is not that hard, at least functionality-wise. In many cases you don't want to improve CVS but incorporate it into a bespoke "revision" system, audio, video, graphics, word documents. Now it can become an enbedded system without any license baggage. That is a good thing. It will enable many software companies and free software writers write new software. That is good.

On the other hand, if there was a mechanism to convince these people contribute their changes back into the wild, it would have been good but it is should not be necessary.

GPL is better in the long run, for the short term solutions, BSD license is much easier to use. No hassle, keep the copyrights and use the code.

Re:The battle continues...

[bastard42]

Too bad the plan9 compiler license isn't compatible with openbsd.

But you have to admit, using "The Creator's" compiler has a certain ring to it. I'd love to see plan9 in more places. Too bad the communities don't match up. Or what little is left of plan9's.

Re:The battle continues...

[setagllib]

I'll still be using the GPL for most of the code I write, because I want as many people as possible to use it

Well you can count out anyone who wants to use it in a closed-source product or environment where stapling the very large GPL to everything isn't practical. GPL just ensures derived code will STAY open forever, it doesn't mean more people will get to use it - less, in fact, unless they flock to it based on license.

Re:The battle continues...

[setagllib]

It's slower than gcc 3? Damn. Does anyone else here remember how fast gcc 2.95 was? You'd think a new, fresh project based on 'correctness' would at least keep up with 2.95, and run circles around 3.

I was excited by the project for the 30 seconds between learning it existed and learning it's actually no better than gcc.

Re:The battle continues...

[setagllib]

Do people really use CVS as a backend for IMAGES and VIDEO? From everything I know of CVS, it is designed entirely for plaintext (notice how many projects uuencode anything they want to store in CVS?), since generating 'diffs' for binary files is impractical, especially compression where changes tend to have cascading effects.

If it's just for keeping a history, that's another story, but then CVS is overkill. I could write an authenticating file server with history and everything in a weekend (second day is testing/refinement of course) in C, no problems. CVS does a lot more than that, and crippling it down to a file server - worse still for files it should NOT be handling - is silly by anyone's standards. I pity whatever big company is doing this.

Re:The battle continues...

[dmiller]

I don't know where you got that idea.

Re:The battle continues...

[setagllib]

Here's where I step in with a favorite URL - http://kerneltrap.org/node/view/4126 - wherein Linus himself points out that GCC 3.x is a generally worse C compiler, with some advantages in C++ compiling being its only real saving throws.

While I can't honestly say BSD projects haven't come under the same kind of problems (FreeBSD 5, for instance, which at least right now isn't a pretty sight), the tendancy is not to replace perfectly fine systems (like gcc 2.95's essential core, which was fast and light) with monstrosities (gcc 3.x). If something new is to be implemented, it has to be Right in design and in practice. If a BSD project wrote a compiler, it would be free, light, very UNIXy (functional, not kitschy), and few people would care because it's not GPL and anything non-GPL must be inferior, right? Some people...

Re:The battle continues...

[dmiller]

The point of the rewrite it to have a secure, readable replacement for CVS. The license thing is just a bonus.

Re:The battle continues...

[Nimrangul]

I think they made the assumption that because some of the developers seem to dislike screwing with the GCC to get it to work on some the platforms beyond ix86 and that there had been some talk about TenDRA some 7 or more months back. And therefore that means the whole team is just waiting for TenDRA to be good enough for OpenBSD.

The whole thing of people wanting tcc has been around longer than I've known of OpenBSD though, since like 1998.

I was of a mind that if yas wanted a BSD compiler that bad you'd have taken a stronger stance and started making tcc work on the platforms. Since you hadn't, I pretty much figured you all had your hands full enough and didn't want to take on such a big project in addition the operating system itself.

Would be pretty neat to have an occ though, I could just see a Puff with a Paul Teutul Sr. "handlebar" styled mustache for the mascot.

Re:The battle continues...

[dmiller]

gcc isn't perfect, but it isn't nearly as annoyingly bad as some of the other stuff we have to use. More importantly, it doesn't have to deal with untrusted network data (like cvs does).

A BSD licensed cc would be nice, but an absolute crapload of work - especially renovating all those programs and ports that depend on gccisms (some of which are perfectly reasonable)

Re:The battle continues...

[Anonymous Coward]

"If a BSD project wrote a compiler, it would be free, light, very UNIXy (functional, not kitschy)"

Yes, YES! Very much like the Plan 9 compiler. ;)

Re:The battle continues...

[Anonymous Coward]

Do you understand the meaning of the word 'correctness'? I'll quote Merriam-Webster for you:

1 : conforming to an approved or conventional standard
2 : conforming to or agreeing with fact, logic, or known truth
3 : conforming to a set figure (enclosed the correct return postage)

See, nothing about speed.

Re:The battle continues...

[setagllib]

Do you write any code? Typically the 'right' solution is fast. What we see in gcc 3.x is not only a colossal regression in performance, but also in quality and efficiency, in both the software itself and the binaries it generates. Performance IS a factor of correctness in code, even if not in the Merriam-Webster definition, which I very much doubt factored in programming ideals.

I don't mean to argue or insult, far from; I'm just saying that, from a software correctness point of view, performance is important. Stability and security are more important, but if performance CAN come without impacting these two (and this is how it was in gcc 2.95), it has to in order for the code to be 'correct'. Debatable, maybe, but that's going to stay the popular view.

Re:The battle continues...

[shnarez]

Then is Open BSD going to stop using GCC ? I mean, GCC is GPL so it is using GPL software to create their system, right ?

LLVM is a BSD-licensed C/C++ compiler (*) and is generating code which outperforms GCC's on some benchmarks, so at some point, OpenBSD may want to consider using LLVM.

(*) currently using GCC's GPL'd C/C++ parser, until someone wants to write a new one :)

Re:The battle continues...

[Eivind Eklund]

> You can't have bits and pieces of code GPLed and some not.

Eh? You definately can, as long as there is an interface separating them. This is both the actual intention of the GPL, and if it hadn't been, there are the legal precedents that licenses don't cross interface boundaries. And the way the BSD projects generally do this is by having different *programs* under different licenses.

> Other licences are more flexible, but are less precise.

I am unsure of what you mean by this. The GPL is textually a brilliant piece of propaganda, but fairly icky when it comes to being easy to read precisely.

> I'll still be using the GPL for most of the code > I write, because I want as many people as > possible to use it, and be fully secure in doing > so.

This statement makes no sense to me. Could you please explain?

I've studied license impact and what beliefs people have around it for years. One of the primary ones are that the GPL necessarily will make for more free code due to commercial companies releasing their code changes (which is only true under the assumption that commercial companies do the same work no matter if they can sell it or not, and/or will keep all changes they can no matter what.)

But I've not seen "be secure" before, and would like to hear the reasoning behind it. I'm always looking for data can make me understand these issues deeper than before.

Eivind.

Re:The battle continues...

[Geekboy(Wizard)]

Does it produce correct code for all supported archs?

Re:The battle continues...

[Anonymous Coward]

Here's where I step in with a favorite URL - http://kerneltrap.org/node/view/4126 - wherein Linus himself points out that GCC 3.x is a generally worse C compiler, with some advantages in C++ compiling being its only real saving throws.

So because Linus says so, it must be true?

Standard benchmarks, run with the same options, same machine, different GCC versions:
2.95, 3.0, 3.1.

Which has the fastest runtimes?

Now it's quite possible, or perhaps, even likely that the Linux kernel has/had a lot of GCC 2.95-specific optimizations.

Re:The battle continues...

[evilviper]

Standard benchmarks, run with the same options, same machine, different GCC versions:
2.95 [www.suse.de], 3.0 [www.suse.de], 3.1 [www.suse.de].

First of all, ignore that 3.1 benchmark, because it was done on a different version of the SuSE distro, and who knows what else might have been changed.

But more than that, you can't compare the performance of some small, simple apps like gzip to what you get with a large and complex project like the Linux kernel. If Linus says GCC3 performed badly when compiling the kernel, most people will recognize that he knows what he's talking about, and is certainly correct... He didn't say anything about how fast gzip might be...

I've personally seen the same thing myself... GCC3 can be faster, but often in complex programs, it's own bugs cause a slow-down, or require you to disable all optimizing options to get a program not to crash.

Subversion

[Ded Bob]

I was about to ask why they did not use Subversion, but I searched Google and found it uses software licensed under at least the LGPL (neon). Of course, they could have just edited Subversion to use another HTTP library like Curl or fetch (at least on FreeBSD). Maybe this has been in the planning stages for awhile.

More than the license.

[NickHolland]

There is a lot more to this than the license, though the license alone would be more than sufficient to justify doing it. While true, CVS is typically a development tool, that is HARDLY the limit of its abilities. What if you want to use a modified CVS to track configuration changes in a non-open source application? Oops! Can't do that with GPL'd CVS.

CVS development has basicly stalled for quite some time. It has reached "good enough" state -- obviously, considering the number of projects that live off of it -- but there are still issues. Check the OpenBSD CVS Commit logs, search for "cvs sucks" and other such non-positive reviews of CVS's operation.

There are also the relative primativeness of some aspects of CVS and its access rights. If you have access to the CVS repository, you can do anything with it... What if I'm not qualified to work in certain trees? What if I fat-finger an scp operation and upload a huge set of files into the CVS directory (no, I *don't* want to talk about it, but it's not a hypothetical concern! :). Then there is just plain simple security: nothing stops any person who has CVS access from being able to go in and directly edit the CVS repository files files OUTSIDE the CVS system, leading to untracked changes in the tree.

And that's hardly all the complaints... If you think "license" is the only difference, you obviously didn't read the goals page very carefully (or believed the one line summary :-)

Re:More than the license.

[Christopher Cashell]

Regarding your first question, I have to suggest that your scenario is rather unlikely. CVS is not something that could be easily integrated inside of an application, nor was it designed to be. Instead, programs that wish to make use of CVS tend to simply utilize it through it's command line interface. By using it in this way from your non-open source application, all you will be forced to make available is the code changes that are specific to CVS.

As for the rest. . . Okay, I can understand that, but if they're trying to build a better CVS, then why are they building on top of a flawed design model?

Especially when there are more advanced and superior options available, a la subversion, darcs, arch, PRCS, etc. You point out that CVS development has stalled. . . bu that isn't quite accurate. What happened is that CVS was largely abandoned by it's developers because it started approaching the limits of it's capabilities according to it's current design.

Most of the former CVS developers are now working on Subversion.

If OpenBSD wanted to fix bugs in CVS, they could do that by simply stepping up and maintaining GNU CVS. If they want to build a better CVS, they'd be much better off basing their work on a more advanced design such as those projects mentioned above.

Reimplementing CVS seems to be the least productive option from my perspective.

Re:More than the license.

[Anonymous Coward]

You should really look at CVS code before saying something like that... it's mostly impossible to fix anything down there.

and there are also some good reasons not to switch to subversion.

You say it's the same developers as CVS ? well, big surprise, they produced another half-finished piece of software.

When what you care about is not extended functionality, but robustness and speed, cvs does not fit the bill. Neither does subversion.

Re:More than the license.

[setagllib]

There's more to it than that, though. BSDs run on a "least surprise" tactic, whereby major systems shouldn't change unless there is something REALLY wrong. The BSDs have all used CVS right from the early versions, and can still be fetched this way. If any of them were to drop CVS support for Subversion, for instance, users would have to adapt, and with the significant user base of BSD, that's quite a disruption.

An honest question: Can Subversion import a CVS history and all branches and everything else relevant without any need for hand-hacking? Because when you want to migrate decades of source to a new system and keep it in working order, you don't want to have to mangle every file by hand. If Subversion does this then it's not entirely impractical to implement it - but since the biggest TRIVIAL (can be fixed without disrupting user base's expectations) problems in CVS can be fixed with a compatible re-write, it makes sense to do it that way. In this regard I congratulate OpenBSD on yet another brilliant and far overdue idea.

Re:More than the license.

[archen]

If any of them were to drop CVS support for Subversion, for instance, users would have to adapt, and with the significant user base of BSD, that's quite a disruption.

Well yes and no. Personally I don't use CVS in any shape or form unless you count cvsup on my ports-building server. CVS has always been in the base system, but does it need to be there? no. CVS has had it's share of security problems and being in the base system only makes it a pain in the ass to fix. Simply put CVS doesn't belong in the base system, it should be a port. FreeBSD moved Perl into the ports section with much success and little adaptation. Now we get to choose our Perl version and get the ease of updates through the port. CVS, BIND, Sendmail - they're all secuirity headaches that have better alternatives and thus are better off as options, instead of part of the install.

Re:More than the license.

[HuguesT]

Have you read and understood the gpl licence?

> What if you want to use a modified CVS to track
> configuration changes in a non-open source
> application? Oops! Can't do that with GPL'd CVS

Of course you can as long as you don't try to sell or otherwise distribute your modified version of CVS.

Modification of GPL sources for personal or internal use is permitted.

Have you actually used CVS?

> If you have access to the CVS repository, you
> can do anything with it... What if I'm not
> qualified to work in certain trees?

Of course you can restrict things any old way you want using basic UNIX permissions. Give your users various groups and you are set to go.

Re:More than the license.

[HuguesT]

I can't believe the amount of falsehoods you are writing.

1-Nobody says you have to use a single repository under CVS. Different trees, different users, different rights. mix and match.

2-You can set up your system so they don't have access to the repository file system using the network code.

I'm an extremely heavy user of CVS and have been for years. I've never come across the so-called problems that you describe.

Moreoever evidently people who believe a particular piece of code needs to be rewritten will try at any opportunity to say that the old code is tripe. That doesn't make it true.

Finally openCVS is being written because of a license issue, not because the basic concepts or even the implementation of the current GPLed CVS are a problem.

Re:More than the license.

[setagllib]

CVS provides a way for BSDs to fetch source without resorting to ports. This is a very good reason to keep it in. Personally I hated having to install cvsup in FreeBSD just to keep sources up to date (if it's possible by CVS itself, it isn't very well documented what servers are useful; when I tried I ended up with half a source tree from a year ago or something), and despite the 'inefficiency' of pure CVS, having it in the base system is a great convenience - and now that I use NetBSD, I can fetch the whole source tree of that and it WILL be the latest.

While this doesn't directly relate to the Subversion/etc debate, it's just my view on why at least a functional CVS client should be in the base system. In the same way the public CVS servers should be kept properly up-to-date and not left behind in favor of CVSup.

Re:More than the license.

[mirabilos]

I'm developer of an OpenBSD fork/derivate (and
slightly pissed off that I heard of this only
yesterday, and not 4 weeks ago or so when they
started; so much for their "live cvs mails"),
and I started to replace our outdated cvs 1.11.1p1
with many many local patches by a modern GNU
cvs 1.12.10 two weeks ago. It's not exactly
compatible with the old CVS, but it works pretty
well for now, and I had not to fix too much.

The code for 1.12 has actually improved a lot.

I won't jump onto the wagon for OpenCVS right
now, even if I'd like to for licence reasons.
First, I'm still pissed off, second, GNU CVS
is well-hung, proven code and we're relying
on it.

Subversion is, how much benz asks it, not an
option. For example, in a subversion repo only
containing the MirPorts Framework, a check-out
temporarily requires about 384 MiB RAM, which
is just too much. Our master CVS server is a
Soekris net4801 with 128 MiB RAM and a 266 MHz
Pentium-compatible Geode CPU, which also serves
as my home ADSL router and firewall.

Plus I don't trust databases.

Re:More than the license.

[mirabilos]

Actually, you can sell GPL'd software. If it's
binaries, you just have to deliver the sources.

And you can't prevent your customers from giving
away for free what they bought from you.

Re:More than the license.

[dmiller]

I'm ... pissed off that I heard of this only yesterday, and not 4 weeks ago or so when they started; so much for their "live cvs mails"

If you follow CVS, then you should already know that most imports are done once a subproject is already at a certain level of maturity. That is what happened with opencvs.

[of subversion] Plus I don't trust databases.

subversion-1.1 doesn't need them. it can use the filesystem for storage

Re:More than the license.

[Geekboy(Wizard)]

so much for their "live cvs mails"

It was developed in another repository, and copied into the OpenBSD repository when you noticed it. The copy was so the history was kept.

So, let me make sure I understand what you are saying. You are pissed because jfb didn't run this by you when he started? How does that make sense?

Re:More than the license.

[mirabilos]

It was not even imported.

One 'cvs add' for the directory
src/usr.bin/cvs

Then M mails for files which ought
to not exist (according to the eMails before)

Re:More than the license.

[mirabilos]

Nah, if I had known that I had not ported GNU
CVS 1.12 and rather peeked into OpenCVS, maybe
helped with it (since I know CVS and RCS pretty
well, after 2+ years of running my own).

Re:More than the license.

[dmiller]

It was imported by copying the repository files that jfb@ has been working in his own cvs tree. You can still get the history from "cvs log", so why is this a problem?

Re:More than the license.

[NickHolland]

Well, guess you have been lucky in your "extremely heavy" use of CVS. Our developers have not been so lucky.

So, you claim people rewrite perfectly good code Just For The Heck Of It, and then make up excuses as to why they spent huge amounts of time on a project? Um...yeah.

And then, you claim to know why this was "really" done. Funny, I don't recall seeing your name on the list of OpenBSD developers. I don't recall seeing you in the internal discussions on this. I do recall seeing many developers have CVS do something stupid on them, following up with "how's JFB's CVS replacement coming along? I can't wait". I can assure you, it wasn't about the license. For the record, I've never had CVS do anything surprising to me when committing but I am certainly one of the lightweight users on the project, and I'd certainly not use that experience as the Universal Experience.

Believe it or not, as a mostly volunteer force, we don't go about rewriting perfectly good software the size of CVS just for grins and giggles. There is WAY too much important work to do to waste time remaking perfectly good wheels. This wheel was ready for replacement. :)

Article Summary Misleading

[eviltypeguy]

I think the article summary is somewhat misleading, the front page of the project claims that OpenCVS is a result of the ongoing security vulnerabilities in the existing CVS project, which has grown stagnant:

The OpenCVS project was started after discussions regarding the latest GNU CVS vulnerabilities that came out. Although CVS is widely used, its development has been mostly stagnant in the last years and many security issues have popped up, both in the implementation and in the mechanisms.

Of course, I'm not going to be stupid enough to deny that there is a great probablity that another unwritten motivating factor was to use a non-GPL licensed piece of software. But, I think time has proven that while OpenBSD may not be a very useable distribution from a common desktop end-user standpoint, a lot of very good portable, secure code has come out of the project. Since I have to continue to run CVS servers for some of the projects I host I look forward to a secure portable CVS server that I can be more confident in.

Re:Article Summary Misleading

[evilviper]

while OpenBSD may not be a very useable distribution from a common desktop end-user standpoint

I have no idea why people keep saying this. It's behind FreeBSD in the number of ports, but it still has all the major stuff available. Firefox, KDE, GNOME, etc. It's a bare Unix system, waiting to be made into anything you want it to be. How can it possibly be unusable for the same tasks that other Unix systems are usable for?

Frankly, I find it to be a bit nicer than FreeBSD, and miles ahead of Linux, in that every device you plug-in will work immediately without problems, or will not work (because it's unsupported), rather than requiring you to load modules left and right, and change parameters, addresses, etc.

Re:Article Summary Misleading

[setagllib]

There's a small thing holding back Net and OpenBSD (I'm an advocate of both, this isn't trolling, just an observation) which is lack of real kernel preemption in favor of clean, simple code. While you do get the most out of your cycles this way (and it shows on lower spec machines), even on higher end machines even moderate load (in my experience, any compile job, even -j1) can make the user interface very unresponsive.

My worst experience (possibly made worse by flaky hardware) of this is NetBSD 2 a couple of days ago, doing a pkg_chk -u round that made my entire day consist of 10-second lag after typing things before they appeared, and almost having to resort to elinks because Firefox couldn't do anything useful. On a DESKTOP system, traditionally an interactive system, this is a Very Bad Thing, since it reduces productivity if the system is under any other load.

The irony is that the Net/OpenBSD approach results in typically better server/overall performance, where 'responsiveness' isn't an issue, and hence they really do make great servers. The way people say "Net and OpenBSD are still for servers" has its truth, but you won't stop me using (at least) NetBSD on a desktop instead of Linux just for the peace of mind.

If there's a clean and simple way to improve responsiveness without significantly hurting performance, it should be implemented. Apparently a new thread scheduler would be enough, but even that is quite a task.

Re:Article Summary Misleading

[eviltypeguy]

Probably because of Theo's purist License attitudes that have caused them to decide to do things like stop distributing/supporting newer versions of Apache because of the 1.1 License changes...

For me personally, it's because it's very user un-friendly.

While there is a ton of documentation, I shouldn't have to read a ton of documentation to setup a basic working desktop system.

But on OpenBSD, I have to do just that...

I've done my own Linux from Scratch system, used Gentoo, used RedHat Enterprise Linux 3 WS, Mandrake, Fedora, SuSE, Slackware and more, but I usually end up going back to my RHEL3 desktop, because for the most part everything works, and it takes less than a half hour to tweak everything exactly like I want it.

Re:Article Summary Misleading

[evilviper]

I shouldn't have to read a ton of documentation to setup a basic working desktop system. But on OpenBSD, I have to do just that...

That's incredibly vague. What is it that you have to know about OpenBSD to setup a desktop? The ports system is quite trivial.

Yes, OpenBSD doesn't come with everything installed as most Linux distros do, but I fail to see how that is a problem. Typing a couple lines doesn't require reading "tons of documentation".

Re:Article Summary Misleading

[Baki]

Hmm, I'm not sure if this is due to the lack of preemption. Years ago, long before FreeBSD had kernel preemption and Linux already had some crude form (maybe 5 years ago), there was already a huge advantage of FreeBSD over Linux w.r.t. responsiveness while under high load (CPU and/or disk). To this day this has remained the case. 5.3 has its problems, but still the scheduling is one of the strong points.

Re:Article Summary Misleading

[setagllib]

Definitely, I found FreeBSD 5.3 to be very responsive (with SCHED_ULE but without the PREEMPTION option, as these two don't seem to rub together well), but it had way too many flake-outs to keep me trusting. Performance aside, things like randomly starting to drop packets on a perfectly fine Realtek 8139 network card until I ifconfig it again (no other system had this problem) really nailed the coffin. In spite of these things it's still a highly usable and functional system, but it doesn't offer enough advantages over other systems (especially DragonFly BSD) to stay a favorite.

This doesn't matter much to Net/OpenBSD (much less the topic itself) but is worth mentioning. If NetBSD had: 1) Support by commercial driver vendors like NVidia 2) A larger range of software in pkgsrc 3) Greater responsiveness under load, it would be a very ideal desktop system, the rest supported by its own amazing attention to code quality and correctness, which result in a system that you can stake your life on in terms of stability and security (and performance is rather amazing in 2.0 too, gives Linux some things to think about).

Re:Article Summary Misleading

[Pseudonym]

Years ago, long before FreeBSD had kernel preemption and Linux already had some crude form (maybe 5 years ago), there was already a huge advantage of FreeBSD over Linux w.r.t. responsiveness while under high load (CPU and/or disk).

I attribute this to the algorithms used at the time.

FreeBSD's algorithms (e.g. for scheduling, virtual memory etc) had extremely good complexity, whereas those of Linux had extremely low constant factors. This meant that FreeBSD worked better under load, whereas Linux worked better unloaded.

Things have moved on in both OSes since then, of course.

Re:Article Summary Misleading

[Anonymous Coward]

If pkg_add "your_windowmanager_of_choice" is too hard for you, then I don't believe you've ever managed to install any OS. Or is it "startx" that has you so confused?

that's not the goddamn point

[Geekboy(Wizard)]

the point of opencvs isn't to randomly replace GPL'd code, but to provide a different implementation, that is free of bugs and security issues. he's also working on other features to make cvs server better, and more secure.

Re:that's not the goddamn point

[Anonymous Coward]

Maybe you should shut yer yap and start coding. When your OcamlSSH has the same feature set as OpenSSH, and runs on as many archs, then you'll have something to talk about. Until then you're just so much hot air.
BTW, the security record of OpenSSH is pretty damn good compared to most other software out there. If you can do better, then show it. Otherwise, shove it. ;)

Re:that's not the goddamn point

[YU Nicks NE Way]

Actually, their track record on OpenSSH and OpenSSL is downright stunning. They've had one security issue in the last three years, and it wasn't a buffer overrun, but a very subtle design error.

But don't let the facts get in the way of a good bit of GPL and language snob demagoguery. That's no fun.

Re:that's not the goddamn point

[TheLink]

Sure seemed like I had to update OpenSSH more than once in the past 3 years. Do a search on OpenSSH and advisory. Just because it's not "exploitable" if you're running it on OpenBSD doesn't really count. That's like saying a security bug in IE isn't a security bug coz it is not exploitable in Win XP SP2.

In contrast I haven't had to update qmail for security problems since I started using it. Like 5 years ago? Or djbdns.

Re:that's not the goddamn point

[0racle]

That was the portable OpenSSH, not native OpenSSH. OpenSSH on OpenBSD has had one problem in the past few years because all the parts that it requires are secure and audited. Porting OpenSSH to other platforms requires them to link to other libraries that have not been written as securly and very often never audited, therefore its not a bug in OpenSSH so much as an unintended interaction because it is outside of its native environment.

Rumor has it that you havne't had to update qmail or djbdns because those projects arn't exactly open to accepting bug reports or acknowledging the fact that there might be problems. I don't really know, I don't use either of them.

Re:that's not the goddamn point

[TheLink]

If the same class of people are doing opencvs then should we assume that the only safe environment to run opencvs will be OpenBSD, until otherwise proven?

As for rumours about qmail and djbdns. I'm sure more than a few people would not be able to resist the opportunity to take DJB down a peg or two ;).

So far I've only seen 2 decent prospects (found by Guninski), one involves RELAYCLIENT being set a certain way (the admin configures RELAYCLIENT), the other involves sending 2GB of data (and finding a way round the fact that qmail-smtpd doesn't run as root). The others are usually some sort of DoS.

They're bugs but I still don't need to update qmail for ANY of the installations I've done for various people through the years.

And my point still stands - if someone like DJB can't write secure overflow free code in C, then maybe it's time to switch to a different language - one not prone to "runs arbitrary code of the attacker's choice".

I still don't feel like running one of those SSHDs written in Java yet though...

Re:that's not the goddamn point

[TheLink]

"Maybe you should shut yer yap and start coding. When your OcamlSSH has the same feature set as OpenSSH, and runs on as many archs, then you'll have something to talk about. Until then you're just so much hot air."

I don't have to be an expert in slashdot posts to know that's a stupid remark.

Re:that's not the goddamn point

[0racle]

More along the lines that the only safe environment for anything is OpenBSD until otherwise proven. You can't blame the OpenSSH project for having to use the most popular and therefore probably default libraries of whatever platform that people want OpenSSH ported to. One of the big things that makes OpenBSD and code that runs on it more robust is the ProPolice patches they have in GCC, something that the GCC developers refuse to add IIRC. In a nutshell, propolice makes it so that any buffer overflow that happens (and they will, developers are still human), the app crashes instead of executing code. That one thing has made OpenBSD the OS most often listed as unaffected by most problems that pop up and its the same result you'd get using a managed language.

The only way that djbdns is completely without bugs is if it is so simple, even a child could have written it. As soon as you add complexity, you add bugs, they might be really nicely hidden if the programmer really is very careful, but they are there. OpenBSD has bugs too, but the choices the developers have made, such as adding ProPolice, reduce the possible effects that those bugs will have.

Re:that's not the goddamn point

[YU Nicks NE Way]

If the same class of people are doing opencvs then should we assume that the only safe environment to run opencvs will be OpenBSD, until otherwise proven?

Yes, actually. If you run OpenCVS on Linus, there will be exploits in your base platform that can be exposed through anything, including OpenCVS.

As to your crack about C, there are a number of ways of avoiding writing buffer overflows in C without losing the power and flexibility of pointer arithmetic. You can use a canary system like propolice or the visual studio canaries. You can run a syntactic lint along with an annotation library to add provability and correctness to your code. You can run on an architecture which supports read-but-no-execute memory. Do any one of these, and you won't have buffer overruns.

Remember, in the two years since it has been released, IIS 6.0 has not had a single remote execution vulnerability confirmed against it. Securia, in fact, can only list three total vulnerabilities, one of which is widely believed to be incorrect. Not a single BO -- and I assure you that IIS is entirely written in C++, and is a constant target of attackers everywhere.

Re:that's not the goddamn point

[runderwo]

GPL uses "free" the same way Iraq used democracy. You are fee to use the code as long as you do it "our" way.

Your sig is the most retarded statement I've ever seen. Obviously you are unaware that the GPL is not a EULA. You also seem to be unaware that using the GPL is just like publishing your work under any other copyright license, it doesn't assign your copyright over to some borg-like collective.

Umm. No.

[nenolod]

In an effort, by Jean-Francois Brousseau (jfb@openbsd.org), to rid the OpenBSD CVS tree of GPL'ed licensed code, OpenCVS is now officially part of the OpenBSD project. For more details, see the OpenCVS homepage; http://www.openbsd.org/opencvs/

Umm. No. That's not what it's about at all. Lets correct the mistakes now, shall we?

1) There was no OpenCVS until the OpenBSD project noticed some major security vulnerabilities posted to bugtraq in GNU CVS.

2) The reason why OpenCVS was written was to provide a more secure client/server package than what the [now stagnant] GNU CVS project is currently providing. It has nothing to do with GPL vs BSD, infact the OpenBSD project is all about what RMS calls "free software".

So basically the Slashdot editors posted a troll to the front page. Beautiful. :)

Re:Umm. No.

[Anonymous Coward]

When can we expect to see this ported to Linux and other platforms too, just as OpenSSH, CARP, etc.? This is great news - OpenBSD guys are great for innovating, improving and well, replacing things better suited for the OSS communit[y|ies] as a whole! Way to go again OpenBSD!!!

Re:Umm. No.

[Anonymous Coward]

> "1) There was no OpenCVS until the OpenBSD project noticed some major security vulnerabilities posted to [seclists.org] bugtraq [seclists.org] in GNU CVS."

So?

> "It has nothing to do with GPL vs BSD, infact the OpenBSD project is all about what RMS calls "free software"."

On the contrary, it has a lot to do with the license and CVS's insecurity.

> "So basically the Slashdot editors posted a troll to the front page. Beautiful. :)"

No. OpenBSD does not want GPL'ed code in the tree.

Just think of why PF came to being.

Re:Umm. No.

[Nimrangul]

ipf wasn't GPL. It was a screwed up altered version of the BSD license; Darren Reed said that people couldn't go changing his ipf around (OpenBSD wanted to integrate it into their kernel) so the OpenBSD developers got a new packet filter.

This is different, yes OpenBSD developers are working at removing GPL tools, but that does not mean they aren't replacing things of other less-free origin.

Replacing the GnuCVS with OpenCVS isn't just over a license; it is more that as long as they're doing such a massive undertaking, they may as well go a little further and start fresh with a better license.

CVS is not dead

[Anonymous Coward]

as much as I use Subversion and other modern alternatives CVS is not dead.
just take a look at what the previously win32-only CVSNT client/server package can do for you.
it runs perfectly fine on GNU/Linux and also has commercial support if needed.

Re:Wow

[setagllib]

You're probably the kind of person who said that replacing the UNIX cc was a waste of time, too. There are reasons besides a niche being filled, you know. Code quality, license freedom, making changes when the original developers won't, etc.

There should be a 'Narrow-minded Idiot' moderation on Slashdot.

Why CVS?

[chrysalis]

I don't see the point.

CVS was nice. But it has some very lousy limitations. Working with branches is a pain, and global revision numbers are really better than per-file revision numbers.

Software like Arch or Subversion are not just "alternative". They really solve issues that CVS had and will always have because of its design.

It doesn't mean that CVS doesn't work. It works. Even very well and even for very large projects.
But people who tried alternatives usually never switched back to CVS.

Re:Why CVS?

[Anonymous Coward]

arch is a different beast altogether (and because of that much more complex) and not finished yet.
svn is still too new for some people to trust it implicitely. cvs is tried and true. a lot of folks will be using it for a long time to come. at least until they feel confidant enough in the alternatives.
don't forget there's lots of people out there who are used to cvs and have come to accept it. just like you're used to the limitations of the networking protocols TCP/IP, SMTP, etc. which are currently known to have problems but there's too much invested in them right now to just switch on a dime. change takes time. the openbsd folks understand this apparently. their solutions so far have been not to reinvent the wheel from scratch but to try and fix it as much as humanly possible. for that i'm grateful!

Re:Why CVS?

[chrysalis]

Well, Subversion is 5 years old, it's not really "too new".

Re:Why CVS?

[MemoryDragon]

Well Subversion having hosted itself for almost 3 years now, having it used myself for almost a year now since it hit 1.0 without a single major issue and not knowing even one single person who had a major problem, that makes it good enough for me. Not to many projects had the quality of Subversion at the time they hit the 1.0 mark. It would call svn not really that new anymore with being usable for 3 years and having hit 1.0 about a year ago and having itself proven to be stable.

Re:CVS IS dead. Long life to CVS

[Zandall]

What you just said is "CVS is dead. Project forks like CVSNT and OpenCVS are alive and healthy". And more important: solving very, very, very old problems. Oooops. I mean, changing very, very, very old "features".

cvsup

[Anonymous Coward]

Hopefully they also create a cvsup utility too. I hate the fact the it only runs on x86.

Re:cvsup

[setagllib]

What about that you need ezm3 to compile it, which is a HUGE download and compile time in itself? I'd be very happy to have a C replacement for CVSup even if it meant writing it myself.

Some welcome project goals

[lux55]

I see the following on their project goals page:

"Provide a much better access control on repository files."

This would be a very welcome addition for myself, and I'm sure for many others. Coupled with security being a higher priority, I'd be more comfortable running a publicly accessible CVS server which hosted both Open Source and commercial projects.

As it currently stands, I stopped offering any more than a duplicate of our tagged releases onto SourceForge since a few CVS security issues ago when not only was a major hack out in the wild, but the CVS web site was down for several days at the same time, leaving me unable to patch my installation. Not good.

Some actual facts

[Anonymous Coward]

http://bsd.slashdot.org/comments.pl?sid=131228&cid =10982290

Some actual facts

[Anonymous Coward]

http://bsd.slashdot.org/comments.pl?sid=131228&cid =10982290

Some actual facts

[Anonymous Coward]

http://bsd.slashdot.org/comments.pl?sid=131228&cid =10982290

A good way to look at it:

[Anonymous Coward]

• GPL ensures perpetual freedom of the code.
  
• BSDL ensures freedom of developers (to do whatever they please).
  

IMHO there's a flaw

[Anonymous Coward]

IMHO there's a flaw, because the BSD code remains perpetually free. Only the enhancements can be closed.

Some actual facts

[Anonymous Coward]

http://bsd.slashdot.org/comments.pl?sid=131228&cid =10982290

Get your facts straight

[dmiller]

If the same class of people are doing opencvs then should we assume that the only safe environment to run opencvs will be OpenBSD, until otherwise proven?

The "class of people" responsible for the bug in portable OpenSSH was me and nobody else - so please don't impugne the other OpenBSD developers.

The fact that the 3.7.1 hole was not exploitable on OpenBSD was due to the fact that the bug related to PAM authentication, which OpenBSD doesn't use (for good reason).

BTW, the bug was a logic error that could have been made in any language, so the standard Slashdolt cry of "C is insecure, use XXX" wouldn't have saved you.

Re:Get your facts straight

[setagllib]

Precisely. People give C a bad rap for not doing enough for the programmer, so mistakes are easy to make. While it isn't 'wrong', it's usually the ones who can't stand to think in a logical and careful way. If you know what you're doing and how the compiler/processor is going to take things, C is possibly the greatest language out there. A few years of experience mentally tracing code makes BOs just not happen.

As for PAM not being used, why? Personally I hate PAM for very little reason, but I'd like to have some reasons for reference :)

Reasons to hate PAM

[dmiller]

1) Poorly-specified - there are several ambuiguities in the spec, some with security implications if you get it wrong.

2) Implementation differences between Linux-PAM, Sun PAM and OpenPAM - as a direct result of (1) above.

3) Useless broken API which is completely blocking (i.e it prompts for an expects to receive the password/response in a single function call) - making is near-useless for a network application without major trickery

4) Broken design that requires loadable modules which are encouraged by the API to pass opaque data behind the back of the calling application

5) Total lack of separation between policy and mechanism - users are expected to configure policy by specifying which loadable modues are loaded using a silly and restrictive grammar.

6) Zero standardisation for modules or their arguments. As a result, everyone implements things a little bit differently.

Those are just the ones off the top of my head.

Re:Reasons to hate PAM

[setagllib]

Wow. Okay, going to make sure I never use PAM even accidentally. Shame many Linux systems seem to basically rely on it; but then I don't rely on Linux systems.

Re:Reasons to hate PAM

[dmiller]

i should disclose that i am embittered from five years of bashing my head against it, trying to make it work for all the obsure uses that people put it to in portable openssh :)

Re:Reasons to hate PAM

[setagllib]

Is it practical to have pubkey authentication not only for SSH, but also for local and indeed any login? This is very untraditional but could certainly fend off the problems people usually have with password authentication. There's a loss of convenience I suppose, but then having no password at all is optimally convenient anyway - and we don't stoop that low.

Re:Reasons to hate PAM

[dmiller]

probably not, unless you can be bothered to type public key challenges and responses (they can be long). If you are concerned about password authentication, use skey.

Re:Reasons to hate PAM

[setagllib]

Wouldn't a new system possibly ask/know where to look for your key, and (like ssh) ask for a password for the private key if there is one? That'd made sense. Just like OpenSSH's public key login, only you do it locally. The difference is that you have to make sure the key itself isn't local, or is at least chmodded safely.

Re:Reasons to hate PAM

[dmiller]

That won't help you for console logins. If you are doing it remotely, then you can use SSL client certs or Kerberos already for most applications.

Re:CVS IS dead. Long life to CVS

[Anonymous Coward]

CVS istelf is also still alife but not feature-enhanced anymore, just critical fixes by Brian Berliner & Co. Think of it like GNU Make maintenance, there won't change much in gmake's features, too.

Great logo

[peacefinder]

Whatever else you might think of the merits of this project, ya gotta admit that it has an amusing logo.

If you don't get the joke, try this.

Two things that I don't get

[rabbit78]

1st: Why has CVS to be part of a unix base system at all? I mean it is useful and all, but completely unnessecary in a base system. The only common use I can see is syncing with the ports tree, but then again: it is fairly easy to go with binary ports (and honestly: I would do so in production environments)

2nd: Does OpenBSD have too much human resources, so that they start such projects? I see that FreeBSD and NetBSD struggle hard with manpower and cannot imagine that OpenBSD has so much more in this respect. I can only assume that OpenBSD developers are far more motivated.

--
Roman
Visualize and organize information easily

Re:Two things that I don't get

[OttoM]

1st: OpenBSD is a developers' system. Having a source code control system is vital to that. Check the OpenBSD goals for details.

2st: It is a question of priorities. The OpenBSD projecty does not want such an important tool (and a networking tool as well) for their development to be of questionable quality. Other posts provide more info why we think GNU CVS is a security hazard.

Re:Two things that I don't get

[setagllib]

1: I explained this in another post, you must have missed it. The BSDs can have sources fetched via CVS (NetBSD recommends this way, rightly so), and having it in the base package makes this infinitely more convenient than having to install the gargantuan cvsup port or poking around for up-to-date-enough source tarballs once daily. Given the relatively small footprint of the CVS client, this convenience is well worth it.

2: They don't have 'too much human resources', you're thinking of Linux. OpenBSD has clear goals and, yes, are motivated to achieve these goals. Security and freedom are goals; this project helps both. The BSDs don't "struggle hard" with manpower, they have as many developers as are needed; everything worth doing gets done. And having less developers is often better for coordination, which is why BSD code bases continue to be consistent and robust.

Re:Two things that I don't get

[Anonymous Coward]

By STEVE LYSAKER, Bigfork Eagle

Area horse owners, especially those around Echo Lake, may want to keep a close eye on their equine companions after two recent instances of abuse and theft.

A naked man was found having intercourse with a horse in a stable on McCaffery Road around 6:30 a.m. on Nov. 17. Flathead County Sheriff Jim Dupont said the man, still nude, fled on foot when the owner of the horse entered the stable.

"He left his boots and a bottle of hand lotion behind," Dupont said.

Also found were a Yoda doll, Crisco, and a ticket marked "FreeBSD anniversary party". Sheriff's deputies concur that the suspect is an unemployed BSD developer.

The incident came just days after a Flathead County deputy reported his horse missing. The horse had apparently been taken from its stable near Echo Lake early in the weekend. The horse was back in its stable by late in the weekend with traces of lanolin around its rectum, Dupont said.

"It appears we have a serial horse rapist," Dupont said. The sheriff's office is investigating, and Dupont advised horse owners to be vigilant. "BSD is dying, and there is nothing which these BSD weirdos won't do in an act of desperation," he concluded.

A *BSD Carol

[Anonymous Coward]

"Spirit," said Scrooge, with an interest he had never felt before, "tell me if *BSD will live."

"I see a vacant seat," replied the Ghost, "in the poor chimney-corner, and a crutch without an owner, carefully preserved. If these shadows remain unaltered by the Future, *BSD will die."

"No, no," said Scrooge. "Oh, no, kind Spirit! say it will be spared."

"If these shadows remain unaltered by the Future, none other of my race," returned the Ghost,
"will find him here. What then? If it be like to die, it had better do it, and decrease the surplus operating system population."

Scrooge hung his head to hear his own words quoted by the Spirit, and was overcome with penitence and grief. It was sad to see any operating system die, even one so obviously flawed and useless as *BSD.

God bless us, every one.

Some actual facts

[Anonymous Coward]

http://bsd.slashdot.org/comments.pl?sid=131228&cid =10982290

What Got Smith and Hubbard Fired

[Anonymous Coward]

Mike Smith's and Jordan Hubbard's employement at Apple was terminated on November 25, 2004. Apple had no official comment, but persistent rumors cite several reasons for the action:

both Smith and Hubbard consistently advocated odd, peripheral priorities for MacOS, such as adding a usermode similar to the one Linux has. No one is sure how the average MacOS user would make use of such a feature.

both developers, Hubbard in particular, were said to behave like serious primadonnas, bothering Steve Jobs with inane technical details and arguing for needless "improvements" while ignoring the projects they were supposed to be working on.

most recently, the two are said to have started an argument in an Apple hallway that degenerated into an out-and-out fistfight, eventually broken up by company security staff. The fight was apparently over differing approaches to SMP support.

There's no word on Smith's whereabouts, but Hubbard is said to have taken a contract job as a Python programmer for a Salinas, CA waste management company.

Some actual facts

[Anonymous Coward]

http://bsd.slashdot.org/comments.pl?sid=131228&cid =10982290

Some actual facts

[Anonymous Coward]

http://bsd.slashdot.org/comments.pl?sid=131228&cid =10982290

Re:The battle continues... NOT.

[Anonymous Coward]

Hey, Dipshits.

Do you actually read the links you post to, or do you just do it to make you look like your informed and know what the hell your talking about?

Personally I don't give a shit which GCC version you use. Couldn't care less, but when you take a qoute out of context and try to twist it so that it makes a person look like they are saying isn't what they are saying.

Linus mearly states that EARLY 3.x series were ass. And they were, but who gives a shit? Kernel version 2.6.0 and 2.6.1 is @ss compared to the stability of 2.4.27, but noboby goes around talking shit about how bloated and slow 2.6.10 is!!

from Linus:
The gcc-3.x series was basically not worth it for plain C until 3.3 or so

So until 3.3 he wouldn't use it. Now he does.

You bunch of fucking trolling morons. Get with the program and stop thinking that your all of a sudden so fucking superior to people who actually produce usefull programs because you can point at qoutes out of context to prove your point and support your who-the-fuck-knows-what personal agenda.

Sounds like a useless work to me

[MemoryDragon]

Why did they rewrite cvs code to have it bsd compliant, they could already have used svn, which has been under a bsd license since day 0 of its existence. CVS was nice, but its drawbacks are obvious, it is time to move on.

Re:Sounds like a useless work to me

[Nimrangul]

You should try reading the posts made before you, your query was already answered.

The remade CVS because they already use CVS, they wish to keep their history in tact.

And Subversion is not, I repeat not, under a BSD license. It is like the Old Apache license, which is not a BSD license.

No, that dude is on drugs.

[Anonymous Coward]

Tendra is noticably faster than gcc2, nevermind gcc3, at least on all the code I've written.

That is the best post on Slashdot

[tjstork]

...that I've read in weeks. Sadly, I used my moderator points somewhere else before I got to this. Hopefully someone else will do the obvious and mod it up.