Slashdot Mirror
OpenBSD 5.6 Released
An anonymous reader writes Just as per the schedule, OpenBSD 5.6 was released today, November 1, 2014. The theme of the 5.6 release is "Ride of the Valkyries". OpenBSD 5.6 will be the first version with LibreSSL. This version also removed sendmail from the base system, smtpd is the default mail transport agent (MTA). The installer no longer supports FTP, network installs via HTTP only. The BIND name server will be removed from the OpenBSD base system. Its replacement comes in the form of the two daemons nsd(8) for authoritative DNS service and unbound(8) for recursive resolver service. OpenSSH 6.7 is included along with GNOME 3.12.2, KDE 4.13.3, Xfce 4.10, Mozilla Firefox 31.0, Vim 7.4.135, LLVM/Clang 3.5 and more. See a detailed log of changes between the 5.5 and 5.6 releases for more information. If you already have an OpenBSD 5.5 system, and do not want to reinstall, upgrade instructions and advice can be found in the Upgrade Guide (a quick video upgrade demo is here). You can order the 5.6 CD set from the new OpenBSD Store and support the project.
>The installer no longer supports FTP
With FTP acting as fragile as glass in the world of NAT and firewalls, I don't see this as a bad thing any longer. HTTP is reliable when serving large files these days.
OpenBSD is fantastic. Thanks to the developers who spend so much time to make it work well!
I thought GNOME depends on systemd? Does OpenBSD come with systemd now?
Also related, Peter N. M. Hansteen is auctioning off the first signed copy The Book of PF, 3rd edition. He will be supporting the OpenBSD project by donating the amount raised to the OpenBSD Foundation.
http://bsdly.blogspot.com/2014...
[Citation needed]
Seriously - is there anything that OpenBSD does better than ?
Internet slide shows suck, but a "10 reasons OpenBSD is better than linux" would help out a lot here.
Seriously? The last ditch and unsuccessful attempt by the forces of heaven to prevent the destruction of Valhalla is not a good omen. The forces of good are overwhelmed by the forces of evil despite heroic efforts. I think Carl Jung pointed out that the Norse mythos was the only one he knew of where good does not triumph in the end. Or perhaps it was a reference to 'Apocalypse Now'. In ether case, as I said, not a good omen.
putting the 'B' in LGBTQ+
Just about EVERY SMTP MTA is named "smtpd". Sendmail's is, but so it Postfix', and so is OpenSMTPD's.
In case anyone wants to know, OpenSMTPD replaces sendmail as the default MTA in OpenBSD 5.6. Now how hard was that, to actually state a piece of useful information instead of a nonsense phrase conveying nothing?
1. OpenBSD supports laptops, specifically Thinkpads, better than any other operating system not called Windows. Suspend/resume works, instantly.
2. Does not require PulseAudio, but can still output multiple channels from multiple apps at the same time. This was always a problem with ALSA.
3. PF is a lot easier to configure than ipfw. It is the firewall of OSX.
4. Man pages for EVERYTHING.
5. A simple init system. Whether or not it is better than systemd is debatable.
6. Not tied to any one desktop environment. Gnome 3.x is well-supported, but not requisite for anything.
7. The first place you will find updates for new wireless cards, OpenSSH, LibreSSL, libc (Android actually uses this instead of glibc).
8. Full disk encryption without requiring an unencrypted boot partition, unlike Linux.
9. Simple, text-based config files.
10. No need for HAL or *Kit or whatever flavour of the week abstraction layer is needed for interfacing with your hardware.
OpenBSD is not for everybody; there is a steep learning curve and a lot of software is not supported. But if you need a simple operating system that doesn't change much from release to release, it's worth checking out. If you are looking for an alternative to systemd (which I honestly have no problem with), check out OpenBSD before checking out FreeBSD, and I cannot stress this enough. FreeBSD developers don't use their own operating system; they run it in a Virtual machine on their Macs, and it shows. Suspend/resume has been broken there since 2008, and drivers for any recent Intel graphics adapter will not run (you cannot switch from Xorg to a console and back) properly. FreeBSD devs do not care about their OS; OpenBSD devs actually use their system.
When they introduced that SystemD trash in Linux, I packed my bags and moved to OpenBSD. Have not looked back.
I run OpenBSD on some computers from the early 1990s without any performance problems.
Sure if you're hoping to play a real-time FPS at 4k you're probably out of luck, but for networking or just as a regular laptop with chrome I don't have any problems. Please state some facts about what you're finding to be slow instead of making unsubstantiated claims.
If you say it's the same team that works on bases system and ports, then I don't have the knowledge to take issue with that. I would not have guessed so, though.
At any rate, OpenBSD has this to say: "The ports & packages collection does NOT go through the thorough security audit that OpenBSD follows. Although we strive to keep the quality of the packages collection high, we just do not have enough human resources to ensure the same level of robustness and security."
I think it's a pretty big deal.
They also removed apache from the base OS and added their own httpd in this release.
blah blah blah. still no hard facts. blah blah blah.
ps. i've tried linux and freebsd for years. linux may be fast but what good is fast if you can't trust the results due to buggy code. I know exactly what I'm "missing out" on.
It's not so cut and dry. That warning is more about not blindly trusting stuff in ports. There are some things in base that are really written by the OpenBSD team and some things that are integrated from 3rd parties. For example I bet that gcc in base is not particularly as well audited as code that originated from the openbsd team like libc or the kernel. And there are some things in ports that are incredibly well audited. The biggest problem is that there is a gazillion times more code in ports so a team of 100 people can't reasonably be expected to read every single line there. but Lynx, Apache etc in ports that are actually used by devs probably get more scrutiny than other ports that might not be widely used by devs.
"simplicity and security" are merely excuses to compensate for the lack of manpower.
OpenBSD's malloc implementation is noticeably slower than anyone else's. It is, however, more likely to make certain categories of memory management error crash the program (rather than leaving it in a state where an attacker might be able to exploit the bug). Unfortunately, most modern exploit techniques don't rely on the invariants that OpenBSD's malloc() breaks, so you end up paying the performance cost without getting much by way of security gain (unless your attacker is a script kiddie who is using 5-year-old scripts).
I am TheRaven on Soylent News
Do you have any benchmarks? Last I read it is only like 2-5% slower than other OS's malloc. As a developer I find testing on OpenBSD very useful. If I can get my app to run there with all the memory and sanity checks then I feel better about my app having fewer bugs.
btw, I know there are ways to cirucumvent each of the memory protection techniques used by OpenBSD in isolation, but as far as I know there is no way to circumvent things if all the techniques are used at the same time. So I'm not sure I agree with you that there isn't much security gain. I especially like their recent addition of the stack shuffle switch to the compiler. I've been using it on my app.
I second the thank you to the developers.
What I like about OpenBSD.
There are no black boxes. I can do a "ps aux" and very easily understand every process that is running and it only takes up one page on the terminal. I use linux for my desktop/laptop and it is great for that but there are pages of processes running and I have to hunt to figure out what some of them are. If I want to understand the boot process it is well documented and I can edit a few files and figure it out.
PF. PF is a great firewall with some amazing features.
Secure. Again only processes running that I want running.
Small footprint. I just downloaded the 5.6 AMD64 iso. 227mb. It got smaller from 5.5 to 5.6. You never see that.
I find it a pleaser to work with. It doesn't make a lot of assumptions for you. Easy install. Give it a try.
How can you do a security audit on something complex? I don't think it's an excuse, I think it's totally reasonable. For example take a look at Bernstein's crypto library which OpenBSD makes use of. Bernstein (who many consider a genius) specifically designed the library to remove the many knobs that other libraries include. And he did this specifically to increase simplicity, thereby being easier to audit and therefore more chance of actually being secure.
I don't buy your argument one bit.
I'm guessing it's the apps. OpenBSD is probably great for servers, but does not have all the desktop apps as Linux.
Or, maybe I'm wrong.
I am really hating Red Hat's hostile takeover of Linux. I may consider a BSD.
If you claim OpenBSD malloc is inferior to other OSes, how do you explain OpenBSD as the more secure OS out there? On Snowdens NSA slides, OpenBSD were noticeably absent on all slides. All major OSes were compromised, except OpenBSD. That's a fact. OpenBSD is safer than Windows or Linux. NSA can not get into OpenBSD servers.
It's been a few years since I did any benchmarking, but back then it was 10-20% slower than jemalloc (the FreeBSD default malloc). Some of the slowdown was hidden in microbenchmarks (worse memory fragmentation, so more cache misses after programs have been running for a while), but anything that did a lot of memory allocation - especially short-lived allocations - was noticeably slower. Unfortunately, this is the kind of overhead that encourages people like the OpenSSL devs to ship their own buggy allocators to avoid the overhead of the system one.
I am TheRaven on Soylent News
If you claim OpenBSD malloc is inferior to other OSes, how do you explain OpenBSD as the more secure OS out there?
I said it was slower, not inferior. It does provide slightly better safety, but if you've got a targeted attacker then you can still bypass the protections.
On Snowdens NSA slides, OpenBSD were noticeably absent on all slides
So were ReactOS and Haiku. OpenBSD most likely doesn't have enough market share for the NSA to care about. Things like the OpenSSL vulnerabilities that they knew about all worked fine on OpenBSD, so there was no point in investing effort in finding OpenBSD-specific exploits.
You'll also notice that OpenBSD hasn't shown up in publications in top-tier security conferences much for five or so years - exploit mitigation targets in other systems were more interesting to try to break.
I am TheRaven on Soylent News
No, I mean that they broke the ones that OpenBSD comes with and OpenBSD hasn't added new ones for years. They're no longer interesting as a target for security research.
I am TheRaven on Soylent News
wrong, developers of your bloated Gnu/Linux distro of choice are using OpemBSD project code to compensate for lack of ability in key areas such as security.