Slashdot Mirror
OpenBSD 4.7 Released
An anonymous reader writes "The release of OpenBSD 4.7 was announced today. Included in this release are support for more wireless cards, the loongson platform, pf improvements, many midlayer filesystem improvements including a new dynamic buffer cache, dynamic VFS name cache rewrite and NFS client stability fixes, routing daemon improvements including the new MPLS label distribution protocol daemon (ldpd) and over 5,800 packages. Please help support the project by ordering your copy today!"
I don't know why it shouldn't be able to. Make sure the NFS versions match (NFS3, NFS4)
I'm starting to think GNU is the problem with "GNU/Linux" these days.
If I can't see examples of OpenBSD running Gnome with transparent Conky over a red Lamborghini Murcielago wallpaper and maybe some cascading green character columns like the Matrix, I'm going back to Ubuntu.
Rich And Stupid is not so bad as Working For Rich And Stupid.
Yeah, I use OpenBSD. My firewall's named linksys and the SSID is default, both for sheer entertainment value. OpenBSD like anything else has its flaws: namely a insular and hostile user community and theocratic leader with a vision. On the other hand it's people like that who get things done.
It would be nice to do more with OpenBSD than I can now, but last I checked ports didn't have the latest asterisk, getting the latest Java running is a pita, the latest Apache has an incompatible license or something, ZFS will never be supported, etc, etc, etc. But staying up with the latest software isn't really a design goal for Theo & crew. It's sort of the PVP UNIX - no care bears welcome. Their targeted approach to security over features makes it the best OS out there for targeted uses, but who knows if they'll make it to 5.7 - decreasing relevance and due to narrowing mainstream software support definitely also narrows interest.
Regardless, congrats on another great release.
Be careful with the settings of the no-df bit in TCP fragments, which Linux NFS generates and expects, while PF rightly blocks when scrubbing. The PF FAQ is your friend there.
When it came to things like OSPF, BGP, routing, filtering (pf failover) and that sort of networking things, Linux hasn't been the best (though queuing and protocols have had some innovations and dev work).
Anyone have an opinion on this?
For example, Zebra was basically abandoned (it sucked anyway), which now became quagga -- if I wanted a Cisco, I'd get a Cisco. Stop trying to make it a damn emulator.
BGP? I don't even know if there is anything.
iptables is cool, but it just doesn't have failover like pf has (I want people with real-word experience, don't tell me "it's supported" when it's crap.)
Oh come on now... The title is inflammatory and tone is combative. Unsurprisingly the discussion at guy's blog degenerates pretty quickly.
I don't really disagree with most of his central points: Secure by default isn't really useful to most people; OpenBSD needs more security features than older UNIX ones; and the OpenBSD team does themselves a huge disservice with their "not invented here" syndrome... But really the whole thing could be been written with a more professional tone and fostered a lot more constructive discussion.
Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
I started using OpenBSD at version 2.7 after a few years using various versions of Redhat linux and Mandrake.
I was hooked right away.. It was a lot of things. Maybe the first was the really easy installation process... In my opinion it still might be the simplest out there. There is the well written man pages.. And the simple 'full' installation. It was easy to understand where everything was and it mostly stayed that way from release to release. The config files seemed easy to read and the firewall was really snazzy!
They do some good work! I enjoy using it, even if all I am really doing is small scale hobby work.
He is talking about what prevents OpenBSD from being a secure system for the points you mention.
I found the discussion on the blog quite interesting aside from the insults, which are a minority
Used to be that the Plaid Tongued Devils provided a new song for every release - this is the first song I've seen by someone else.
For every problem, there is at least one solution that is simple, neat, and wrong.
Perhaps every Ubuntu release story should have a link to a site titled "The Unusability of Ubuntu." Seems fair, doesn't it? The article would necessarily have to be negative... title non-withstanding. Slashdot has turned seriously hostile to non-Linux open source operating systems. I'm not sure why. I've even heard people here use the classic, "nobody uses it, so it must be bad" argument - the same one Windows users make about Linux.
Maybe if the article had any real merit, instead of making stupid statements that aren't true.
It's a shame the author's love affair with MAC can't help him write a decent article.
I wonder how many installations of Linux have SELinux disabled because it broke something.
The things that are pioneered by OpenBSD, often make their way to everywhere else.
So, ahem, it IS invented in OpenBSD.
The fact that the OS code is audited is nice, but can't protect against other insecure software. If you run postfix which isn't audited, and it has a hole and the attacker gets root, then there is nothing to stop them.
Maybe I'm wrong, but if the mail server isn't crap it should give up root privileges as soon as possible. So, to get root you need to do two things.
1) Exploit a bug in the mail server
2) Exploit a bug in the operating system to gain root privileges
If MAC is part of the operating system, and can therefore contain operating system bugs, how does it mitigate step 2? How does it mitigate it any more than an operating system without MAC?
An example from a commenter on the blog is that he needed to prevent root from reading users files. OpenBSD is almost the only OS left that can't meet this requirement.
Are you serious? The root user has ultimate power by definition. That's been the case with *NIX for decades.
While I consider your comment as 'Interesting', if not 'Insightful', I still can't approve of your
This is the story Slashdot should have included to run.
The story is about the release of the most recent OpenBSD, 4.7; its availability, funding, etc. The discussion about its 'lack of security' is surely of a very different nature.
Having read the article mentioned by you (I saw 43 comments,?), I can only agree - and I knew that for long - that OpenBSD has no access control systems on top of the Unix-permissions. If they should be there, and how their lack renders OpenBSD less secure than Linux, is quite another topic. Actually, I was kind of disappointed when reading the article, because it focuses solely on access control to crack OpenBSD. So even the title was badly chosen: the article talks about a perceived 'lack of a security feature' or something to that behalf; not about an 'insecure' OS. And yes, there is a difference, and the article is clear about it: If, and only if, the system is broken into (already), can additional access controls eventually contain damage.
It is Mac, not MAC. And while we are at it, it is pronounced OS ten, not OS ex. I find the two mistakes are highly correlated.
There is more to science than physics!
www.iomalfunction.blogspot.com
IMHO if someone has problem with OpenBSD community/leader, he should hang at Mac community/websites/mags and especially IRC channels for a while.
I also think OpenBSD theocratic leader and hostile community could be the reason why OpenBSD has its unique and prestigious position today... We all heard how many users got banned for questioning inclusion of Mono to a "user friendly" Linux OS distro which has democratic leadership right?
Most of us have been reading slashdot long enough that "several times a year" qualifies as sufficiently regular.
And yet going back even farther to more than 6 months I've yet to see a single one of those supposed articles that criticize Linux security. Care to actually link to even a single article that isn't more than a year old?
I wonder how many installations of Linux have SELinux disabled because it broke something.
The overwhelming majority, in my experience.
The mailserver is just an example. There is plenty of insecure software running as root.
FTFY
MAC cannot prevent the exploit as such, but it can make the attacker completely limitless. You can take away execute permission, write permission (allowing just append), no file creation, absolutely nothing except the very minimal that the program actually needs.
This sounds a lot like what securelevel(7) already does.
There is absolutely no reason to have a user with absolute power when we have the technology to segregate power and duties, there by significantly reducing the attack surface.
There is absolutely no reason to put up walls so the sysadmin can't do anything, rather than fix the bugs that let an attacker gain root in the first place.
so I didn't want to use my bandwidth for my fun and used a free hosting service instead for my photo, big deal. It'll be accessible for at least a year. And even then by context anyone can deduce my point that OpenBSD runs GNOME and Conky with effects just dandily, even on laptops.
the concerns of that "link shortener" article are laughable. Author is warning of a doomsday when archives of posts from Twitter and other social networking sites become a tangle pile of broken links because of "short URL use" (or more to the point, because of use of free file hosting).
All the while forgetting that Twitter and such are driven by twits and twats who post the most inane and useless offal. In short, article is fretting about useless spew of garbage becoming more useless. Let the shit bit-rot.
Uhm... Yeah.
Why use a cheap arm toaster that can be set up in 5 minutes when you can give CISCO a few thousand dollars for a piece of shit?
Because that toaster doesn't provide real support and next-day RMA service. You might work in a small shop, but for people who run multiple datacenters, 100s or 1000s of network devices, and whose jobs rely on uptime this is a no-brainer. I'll take the appliance with the service guarantee, replacements, and track record over a few Dells with *nix running on them.
You are not allowed to replace a $10000 router with a $100 redundant array of consumer hardware because it would make your boss look bad.
I can see why you posted AC. You're out of your depth. Cisco may churn out some real crapware ancillary platforms sometimes, but when it comes to core routing and switching on the big chassis, they're pretty damned reliable.