Slashdot Mirror
OpenBSD 4.6 Released
pgilman writes "The release of OpenBSD 4.6 was announced today. Highlights of the new release include a new privilege-separated smtpd; numerous improvements to packet filtering, software RAID, routing daemons, and the TCP stack; a new installer; and lots more. Grab a CD set or download from a mirror, and please support the project (which also brings you OpenSSH and lots of other great free software) if you can."
OpenBSD is 14 as of today.
Today would be a great day for even a little gift. ;-)
I just want to give a huge Thanks to Theo and the rest of the OpenBSD developers. They're doing a fantastic job. I'll order my CD soon.
Doing what others only dream... a scheduled release, early!
They have lots of mirrors and they likely work well, but with a torrent I could help pass it around.
What is with projects not offering the option?
20 characters max for the password? How will I use my favorite poems as passwords?
OpenBSD has had the RAIDframe driver for a long time. This releases is adding some sort of RAID 4 and 5 implementation.
Come on! FreeBSD has been releasing via bittorrent for a while now. Get with it OpenBSD!
ah, that's super easy, have you ever even tried to read the docs? If 10.0.0.1 is a gateway that people are nat'd behind, something like block in from 10.0.0.1 to 192.168.0.0/24 in pf.conf, done. pfctl -n -f /etc/pf.conf to check that the grammar is correct, and pfctl -F rules -f /etc/pf.conf to reload the rules. If you mean you need to set up the openbsd box to *do* nating it's still pretty simple. All it takes is a quick look at the PF documentation.
"If you plant ice, you're gonna harvest wind."
Most places using it use it for site-to-site VPN, routers, firewalls, etc, so A. only people from significant sites probably know the answer and B. it's not really what it's known for being great at.
"If you plant ice, you're gonna harvest wind."
Where's the song? There was supposed to be an earth-shattering song!
Anyone know of the preformace? Been using mdadm for a while and been liking it.
OpenBSD's FAQ explains their choices regarding ISO images.
I like to install OpenBSD from a floppy image - only 1.44 MB! I then choose an FTP mirror and install whatever parts I want on the fly.
*BSDs (all of them) still lack HA and failover clustering software.
Ironic in a story about an OS release that features improved HA networking.
Dewey, what part of this looks like authorities should be involved?
No, why troll... First, Yahoo is not only on BSD. Second, BSD is widely in a Cisco stuff, mostly for network appliances, routers, firewalls etc. It is very good firmware-like OS for network stuff.
For everything else you've got Solaris... :-)
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/nutshell.html#INTRODUCTION-NUTSHELL-USERS
Many, many not listed, one example is php.net.
brandelf -t FreeBSD
Do you have any clue who is responsible for developing Common Address Redundancy Protocol?
You have other options too,
http://www.freebsd.org/cgi/cvsweb.cgi/ports/sysutils/heartbeat/
or for a DRBD eqiv, try ggated + gmirror
http://serverbbs.ccw.com.cn/thread-14564-1-1.html
brandelf -t FreeBSD
Aye, just notice the use of semicolons and commas in the sentence :-)
Becomes:
Numerous improvements to: (packet filtering, software RAID, routing daemons, and the TCP stack);
(but yes I did read it for a moment as saying that one of the new things was a TCP stack!)
The revolution will not be televised... but it will have a page on Wikipedia
The story points to plus46.html which isn't useful for a general distribution announcement like this. Here's a much better choice (which includes a link to the plus46.html page):
http://www.openbsd.org/46.html
or
http://www.sigmasoft.com/~openbsd/archives/html/openbsd-announce/2009-10/msg00001.html
for the record, i submitted it with different links. plus46.html was originally linked from the text "and lots more." they "improved" the links in the story before they published it.
if i'm a grammar nazi, you're an illiteracy nazi.
I use it for my father's site-to-site VPN and the ease of configuration of OpenBSD's ipsec.conf makes it wonderful. It is highly reliable and, in the two years I have had it implemented it went down due to the failure of the onboard NIC in a Dell Server. I simply threw in a spare INTEL PRO/100 (em) and it was back up within 5 minutes.
Funny, I thought that was what CARP and pfsync were. They are for failover but I don't know about clustering and load balancing.
OpenBSD security is in large part overstated, and at worst, a myth.
Let us look at 3 main points, of which the last is the most important.
1. Secure by default. Yes, having services turned off by default is a good move. It also actually has nothing to do with the security of what you actually have running.
2. Auditing. Only the base system is audited. The ports are often quite far behind. Most attacks are not against "the base system".
3. Lastly...OpenBSD, by design, is not a secure system. A secure system is much, much more than just a lack of vulnerabilities. It is the ability to have controls and lock down things, to prevent unauthorized access. Instead, the OpenBSD approach does it's very best to assume that people don't get in, but does little to help when something does go wrong. Or, you know, if you even wanted to actually restrict access with more than just the user/group scheme. Hell, they don't even have a basic ACL. VMS was a secure system. Very recent editions of Windows are well on their way to becoming secure systems. OpenBSD is not.
In fact, as it stands, Linux is a far, far more secure system, because of access to things like SELinux and RSBAC. These frameworks allow you to lock down and control every aspect of your system. Anything you want to restrict and how, you basically can. It takes the "everything is a file" philosophy to the next step. These systems are more secure for one simple reason. You should be prepared in case someone does, not simply try to eliminate all bugs all together, which while noble, is a flawed attempt. Not to mention the inability to restrict legitimate users on the system in a limiting way...
Instead, if someone successfully gets root on OpenBSD..then they have root, This is getting better with privilege separated stuff, but Linux had this in 3rd party patches about 10 years ago. With SELinux and RSBAC, you can remove the concept of root. If someone hacks a webserver...well, the webserver does not need write access, except maybe to tmp, it won't need execute access, it won't need to initiate outgoing connections, and it won't need write access, only append access to /var/log. The attacker can't do anything, and you simply can't do something similar with OpenBSD.
In fact, despite Theo being staunchly opposed to such attempts, there was one. Systrace. It was nowhere near as powerful or flexible as the aforementioned frameworks, but it was a start. Instead, The developers decided to use an insecure technique, system call interposition, shown to be insecure. After this they gave up.
OpenBSD is an extremely quality codebase, and it is more secure for small stuff and does make a good router or firewall. It is by no means a secure system though, and should not be hailed as one.
If you ignore ACs because they are anonymous - you're an idiot.
"floor" is one of those functions... ugh.
Depending on what language/program/whatever you're using, it'll either round towards -inf (as apparently they've patched this one to do), or towards 0. The mathematical definition of the term "floor" is -inf, so I guess this change makes it "more correct." But God help you if you have a program that relied on the previous behavior.
Comment of the year
It's true, but the OpenBSD FAQ only lists RAIDFRAME and not softraid. I suspect that will change in a release or two.
When I looked at the release notes sent out by email, I saw this under "New functionality":
"httpd(8) can now serve files larger than 2GB in size."
I'm very surprised by this.
Rock solid, thought through and very conservative.
They have their niche and do their best to serve it as good as they can. I'm very glad that this project exists even though I don't use OpenBSD but various of its offsprings (OpenSSH/SSL, etc.) only.
Theo is a very controversial person but at least he keeps the project on focus and going. Congratulations for that and best of luck for the future.
I don't see myself using OpenBSD anytime soon but I know a few people that do and they are happy with it. So keep going, the community needs you!
FreeBSD is already at 7.2! No way they can catch up now, unless they pull a Windows.
Apparently, softraid is also included in the GENERIC kernel. This means that, unlike with the old RAIDframe, you don't have to compile your own kernel before you can use it.
Please correct me if I got my facts wrong.
Well, IIUC, that would just entail converting all floors on negative numbers to ceils:
double floorToZero (double n)
{
return (n < 0) ? ceil(n) : floor(n);
}
CARP and pfsync can provide a virtual IP address managed by a cluster to act as a frontend to N web servers, but AFAIK (and no I haven't RTFA) they don't have anything else to help like a clustered filesystem, a web server that clusters so sessions can fail over within the cluster or anything fancy like that.
Depending on what language/program/whatever you're using, it'll either round towards -inf (as apparently they've patched this one to do), or towards 0.
This cursed wrongness of many implementations of floor (returning closest integer not further from zero) has caused me no end of hassle through many different environments. The bugs can be quite subtle, but significant, and occasionally really weird. This uncertainty in floor behavior is not limited to c-libraries, but can also be encountered in some higher-level analysis packages, such as in graphical programming environments and interactive data analysis packages. After being bitten in the butt too many times, I now always supply my own floor function with the correct behavior (returning closest integer not greater than input) in source code, or add a DLL or lib with such a module to any packaged environment.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
OpenSSH is developed solely for OpenBSD, to not bloat the code, then they have a separate team working on making it portable to other OSes
Dyslexics are teople poo
Comparing the latest OpenBSD to the Ubuntu Server, what are the security advantages of OpenBSD that would warrant it's usage over Ubuntu Server? Ubuntu Server home page boasts quite a lot of security features and I presume it's faster than OpenBSD as well.
Can someone recommend a good platform on which to run OpenBSD which will consume the lowest possible power and let me run a Wireless-G and a Wireless-N NIC in master mode at the same time? I also need 100baseT[x]. Ideally it would run from fairly broad DC power (8-18VDC). I want to spend minimal money :) So far in the running are PC Engines, Mikrotik, and Soekris, in my current order of preference from most to least. I'm willing to have my mind changed, though. SD, USB, or CF storage, I don't care.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Once you notice the bug... after possibly years of extremely subtle incorrect accounting errors.
I'm not saying it's hard to fix. It's hard to find.
Comment of the year
Yeah, it's a huge fucking pain. One of those functions you have to look up for every environment-- even though you know exactly what it's "supposed" to do, you have no idea if it's right in any given environment.
I haven't gone as far as just writing my own all the time, but if the library version is prone to changing from one implementation to another, I really should... that's a bug waiting to happen.
Comment of the year
When I last tried to use OpenBSD, package management was a big barrier to entry. In those days, I yearned for apt-get like ease to set updates and even distribution upgrades automatically. I noticed that OpenBSD added pkg_add several years ago, but I haven't really tried it in the enterprise. How is the package management system today? How easy is it to do hands-off administration of tens if not hundreds of these servers?
http://www.nabble.com/CARP-failover-behaviour-td3490125.html
Under the influence of Post-Cyberpunk Gonzo Journalism
but how does any of that reflect on OpenBSD?
So true. Either the person writing the library or the person writing the program has no mathematical training or little concern over disregarding conventions long associated with quality software.
The authors of APL back in 1963 worked very, very hard to define the computational equivalents of common mathematical notation to preserve and obey the maximal set of mathematical identities. Perhaps they worked harder at this than other language teams because identities are none too compelling expressed in Lisp notation.
Later, when I learned many ideas about program correctness and defensive programming from Dijkstra, his notions of program correctness were highly APL compliant. People don't understand the full gravity of Dijkstra's lament APL is a mistake, carried through to perfection. The only language consistent with his notions of programming elegance was a failed enterprise out of the starting gate. His implied converse also interests me: X, for X != APL, is a valuable step forward, borked beyond all recognition.
The people who brought you floor() truncating toward zero also brought you modulus operators where mod (x,N) == -mod(-x,N) Good luck using that to write an elegant loop dealing with possible negative values of x while ensuring that an array subscript is within the viable range [0..N)
And how about malloc(0) aborting your program on the assumption that a program which correctly handles the empty set (a rare condition indeed) deserves to have multiple extra lines of conditional statements to permanently clutter code review, when falling through the primary code path could have been completely safe. ["rare condition" resolves twice: once for sarcasm, once for cynicism. Lisp notation ruins everything.]
Too many OSes out there refuse to differentiate progress from borkage. Once you inflict enough paper cuts, one begins to think that bugs are a fact of life. Yet a few people out there who refuse to tolerate paper cuts manage to write large chunks of software near to entirely bug free. Mostly individuals, as it happens.
OpenBSD is a bit of a sore point for many people out there who like to crow about their progress unsullied by their borkage. The deep issue here is what ultimately happens to the rotting pea under the mattress? Do all the layers of straw and cotton mask the problem from the princess on top? Or does it just fester down there causing endless problems and sleepless nights?
This came to mind concerning the indicted IBM executive. I was thinking about the common career strategy of presiding over short term success, leaving at the top before the stink catches up with your actions, taking credit for a few brilliant quarters, then repeating the cycle with your next employer (who likely hired you after boning up on sharp trading practices). Our progress detectors are easily fooled.
I think in larger projects, one generally has to burn a few boats to hit the release date. Nothing stops a project from pausing after the release cycle to clean up the mess. I've noticed, however, that several projects that took a significant hiatus to get things right were severely punished by the nattering nabobs of negativism (don't look now, if you're reading here, you're surrounded). Postgres, Mozilla, Perl 6, Snow Leopard all come to mind (as a list, that's a bit of a Lewis Carroll Sesame Street: three of these things aren't not like the other. The yin/yang of car/cdr.).
Since I'm inclined to be dangerously open minded, I haven't made up my mind on Perl 6 yet, especially since the Python people have already released a darn good Perl 5.9
Are there no parallels here between Parrot and OpenSSH? "Man, I don't know what those guys are doing over there, but *just look* at the tools they leave lying around, and the man page *actually explains* how to use it. Too bad about their misguided agenda / abject ind
You/kestasjk make it sound like OpenBSD had to play catch-up implementing NX. FYI, OpenBSD 3.3 was actually the first OS to ship with it (except they called this W^X, "write XOR execute"), 6.5 years ago.
I'll give you that the new "in a heck of a long time" wording in their tagline is unfortunate. It must be ~11 years now, a pretty strong track record I'd say, but feel free to convince me otherwise...
Solaris supported Ultrasparc NX in the late 90s. OpenBSD's innovation was to enforce NX pages on i386 which doesn't have any such hardware support. OpenBSD supports hardware NX of course.
POKE 36879,8
You want relayd, also previously known as hoststated.