6 ms·

OpenBSD 5.1 released

112 points by hackermom 14y ago

KonradKlause 14y ago
- NAT64 support in PF using the af-to keyword. Sounds really interesting.
derleth 14y ago
So what really sets the various BSDs apart? Has anyone done a good comparison between them?
- koeselitz 14y ago
  I actually rather like Wikipedia's page on the three - particularly the matrices of different options for the different BSDs. http://en.wikipedia.org/wiki/Comparison_of_BSD_operating_systems http://en.wikipedia.org/wiki/Comparison_of_BSD_operating_sys...
- bingbing 14y ago
  There's a wikipedia page with tables of differences: https://en.wikipedia.org/wiki/Comparison_of_BSD_operating_systems https://en.wikipedia.org/wiki/Comparison_of_BSD_operating_sy... In my opinion: OpenBSD - Focused on security above all else. Host project of OpenSSH and pf/carp/altq?. Lags behind on architecture support and performance (Previously poor SMP performance?). Primary use: Router/firewall. FreeBSD - All around features and performance (zfs,dtrace,pf,linux syscall emulation layer). The most popular, and I believe has the most development effort. Popular freebsd derivatives: pfSense (firewall appliance), FreeNAS (zfs storage appliance), PC-BSD (packaged up for an easier desktop experience). Primary use: Desktop/server/firewall/storage/database. NetBSD: Focused on architecture support. Supports 57 platforms/15 processor architectures: http://www.netbsd.org/ports/ http://www.netbsd.org/ports/. Primary use: support on embedded/uncommon hardware. DragonFlyBSD: Interesting technologies being developed: HAMMERfs (compare with zfs), application snapshots, virtualized kernel. Matt Dillon's fork of FreeBSD adding the spirit of AmigaOS. Primary use: Compute clusters?
  - jballanc 14y ago
    This is actually a good summary, but it's missing the reason for the DragonFlyBSD fork: light-weight kernel threads. But yes, they've been doing a lot of work around clustering and performance in general.
- fusiongyro 14y ago
  FreeBSD is the one you should run. It has the best performance and hardware/software compatibility of the three. It's the easiest to get off the ground with for a beginner as well, so it's also a good starting point. NetBSD is the one whose source you should study. The emphasis is on correctness and portability. The book Code Reading by Diomidis Spinellis used mainly examples from NetBSD even though he is a FreeBSD developer, because (he implies) the code is easier to read. OpenBSD forked first and developed a reason to exist second; its storied past is really quite an interesting read, but won't leave you feeling like it is being developed by the greatest minds in security for exactly that purpose. I think its secure reputation is more fiat than fact and I'd like to see recent benchmarks substantiating the notion that it is better to run on routers and whatnot. I have no use for it.
  - JoachimSchipper 14y ago
    One reason to run OpenBSD: pf/altq and OpenBGPD/OpenOSPFD are mostly developed there, and the other BSDs tend to have older versions.
  - dchest 14y ago
    NetBSD is the one whose source you should study. Why not OpenBSD?
    - fusiongyro 14y ago
      Because NetBSD's first priority is clean and correct code and it is often used for exactly this purpose.
      - dchest 14y ago
        Have you seen OpenBSD code? It's no less cleaner, and maybe even better in this regard.
        fusiongyro 14y ago
        Have you seen FreeBSD/NetBSD code? It's no less secure. :)
__david__ 14y ago
I love OpenBSD and have 5.0 installed on a router. But man they are old-school. Just looking at the upgrade instructions[1] brings me back to the time before package managers and makes my long for a nice "apt-get update && apt-get dist-upgrade". [1] http://www.openbsd.org/faq/upgrade51.html http://www.openbsd.org/faq/upgrade51.html
- tobiasu 14y ago
  Awesome, isn't it. It's transparent and works every time. Not something you can say about apt-get...
  - derleth 14y ago
    It is in my experience.
  - __david__ 14y ago
    "Awesome", yes. It's also going to take about an hour of my full concentration to accomplish. That's also not something I can say about apt-get...
    - hackermom 14y ago
      The upgrade procedure takes but minutes in itself. The time you take to save and then write your old configuration files back to /etc and whatnot is on your hands :) Sure, upgrading OpenBSD's core system files isn't as smooth as doing it on f.e. FreeBSD via its package manager, but it's definitely not about hours.
- srl 14y ago
  The last successful ubuntu upgrade I did was 10.04 (9.10 on my laptop), I think. 10.04 - 11.10 all broke (on multiple computers, in different ways) eventually requiring a liveboot and significant skill. (I'm now running arch, with significantly better results - but not perfect.) I've never had an openbsd upgrade break, even when I do it the ninja way (which I often do, being a reckless fool). Despite the longer setup time, I've found that openbsd servers end up needing far less maintenance than any others. It works well as a "fire-and-forget" operating system, a quality that seems to be lacking among the larger players. (EDIT: not disagreeing that apt-get, yum, and pacman/yaourt are nice. Just talking about how awesome OpenBSD is.)
protomyth 14y ago
So far so good on this upgrade. Like all the recent versions I would seriously look at the changes to pf.conf. It seems like taking advantage of some of the new stuff would be in order. Also, smtpd seems to be coming along nicely.
agallego 14y ago
I wish I could go back to using it but I currently have to do some GWT dev and they only officially support linux. I tried running a vm and dual boot but that was too much hustle... as soon as I'm done with this project I'll go back to this distro. :)
- thisisstupid 14y ago
  OpenBSD isn't a 'distro'. It's a distro in the same sense that Windows is a distro.
- drhowarddrfine 14y ago
  The BSDs do not have "distros". That's a Linux-ism.
throwaway64 14y ago
one thing to definitely watch in OpenBSD is their new mail daemon, OpenSMTPD. It has a configuration syntax that is about 100x easier to setup and understand than anything else out there, although they are still working to get it up to par feature wise. The code is also written with a heavy focus on security, correctness, and simplicity. Its definitely something to watch for all those hackers that want an alternative to gmail that isnt the insanity of a postfix/qmail setup. listen on em0 map aliases { source db "/etc/mail/aliases.db" } accept for local deliver to mbox accept for all relay Thats all you need for a working mail setup :) http://opensmtpd.org/ http://opensmtpd.org/
- emillon 14y ago
  > accept for all relay If this defines an open mail relay, please think twice because your machine may be used to send spam and get blacklisted.
  - poolpOrg 14y ago
    nope, by default rules have "safe" implicit behavior: accept for all relay -> accept from local for all relay to create an open relay one has to explicitly: accept from all for all relay
- KonradKlause 14y ago
  Let's hope that it does not end like: http://www.opencvs.org http://www.opencvs.org
  - peteretep 14y ago
    How did that end?
    - KonradKlause 14y ago
      "OpenCVS is to be released soon." since 2004
  - 14y ago

112 points by hackermom 14y ago

KonradKlause 14y ago

- NAT64 support in PF using the af-to keyword. Sounds really interesting.

derleth 14y ago

So what really sets the various BSDs apart? Has anyone done a good comparison between them?

koeselitz 14y ago
I actually rather like Wikipedia's page on the three - particularly the matrices of different options for the different BSDs. http://en.wikipedia.org/wiki/Comparison_of_BSD_operating_systems http://en.wikipedia.org/wiki/Comparison_of_BSD_operating_sys...
bingbing 14y ago
There's a wikipedia page with tables of differences: https://en.wikipedia.org/wiki/Comparison_of_BSD_operating_systems https://en.wikipedia.org/wiki/Comparison_of_BSD_operating_sy... In my opinion: OpenBSD - Focused on security above all else. Host project of OpenSSH and pf/carp/altq?. Lags behind on architecture support and performance (Previously poor SMP performance?). Primary use: Router/firewall. FreeBSD - All around features and performance (zfs,dtrace,pf,linux syscall emulation layer). The most popular, and I believe has the most development effort. Popular freebsd derivatives: pfSense (firewall appliance), FreeNAS (zfs storage appliance), PC-BSD (packaged up for an easier desktop experience). Primary use: Desktop/server/firewall/storage/database. NetBSD: Focused on architecture support. Supports 57 platforms/15 processor architectures: http://www.netbsd.org/ports/ http://www.netbsd.org/ports/. Primary use: support on embedded/uncommon hardware. DragonFlyBSD: Interesting technologies being developed: HAMMERfs (compare with zfs), application snapshots, virtualized kernel. Matt Dillon's fork of FreeBSD adding the spirit of AmigaOS. Primary use: Compute clusters?
- jballanc 14y ago
  This is actually a good summary, but it's missing the reason for the DragonFlyBSD fork: light-weight kernel threads. But yes, they've been doing a lot of work around clustering and performance in general.
fusiongyro 14y ago
FreeBSD is the one you should run. It has the best performance and hardware/software compatibility of the three. It's the easiest to get off the ground with for a beginner as well, so it's also a good starting point. NetBSD is the one whose source you should study. The emphasis is on correctness and portability. The book Code Reading by Diomidis Spinellis used mainly examples from NetBSD even though he is a FreeBSD developer, because (he implies) the code is easier to read. OpenBSD forked first and developed a reason to exist second; its storied past is really quite an interesting read, but won't leave you feeling like it is being developed by the greatest minds in security for exactly that purpose. I think its secure reputation is more fiat than fact and I'd like to see recent benchmarks substantiating the notion that it is better to run on routers and whatnot. I have no use for it.
- JoachimSchipper 14y ago
  One reason to run OpenBSD: pf/altq and OpenBGPD/OpenOSPFD are mostly developed there, and the other BSDs tend to have older versions.
- dchest 14y ago
  NetBSD is the one whose source you should study. Why not OpenBSD?
  - fusiongyro 14y ago
    Because NetBSD's first priority is clean and correct code and it is often used for exactly this purpose.
    - dchest 14y ago
      Have you seen OpenBSD code? It's no less cleaner, and maybe even better in this regard.
      - fusiongyro 14y ago
        Have you seen FreeBSD/NetBSD code? It's no less secure. :)

__david__ 14y ago

I love OpenBSD and have 5.0 installed on a router. But man they are old-school. Just looking at the upgrade instructions[1] brings me back to the time before package managers and makes my long for a nice "apt-get update && apt-get dist-upgrade". [1] http://www.openbsd.org/faq/upgrade51.html http://www.openbsd.org/faq/upgrade51.html

tobiasu 14y ago
Awesome, isn't it. It's transparent and works every time. Not something you can say about apt-get...
- derleth 14y ago
  It is in my experience.
- __david__ 14y ago
  "Awesome", yes. It's also going to take about an hour of my full concentration to accomplish. That's also not something I can say about apt-get...
  - hackermom 14y ago
    The upgrade procedure takes but minutes in itself. The time you take to save and then write your old configuration files back to /etc and whatnot is on your hands :) Sure, upgrading OpenBSD's core system files isn't as smooth as doing it on f.e. FreeBSD via its package manager, but it's definitely not about hours.
srl 14y ago
The last successful ubuntu upgrade I did was 10.04 (9.10 on my laptop), I think. 10.04 - 11.10 all broke (on multiple computers, in different ways) eventually requiring a liveboot and significant skill. (I'm now running arch, with significantly better results - but not perfect.) I've never had an openbsd upgrade break, even when I do it the ninja way (which I often do, being a reckless fool). Despite the longer setup time, I've found that openbsd servers end up needing far less maintenance than any others. It works well as a "fire-and-forget" operating system, a quality that seems to be lacking among the larger players. (EDIT: not disagreeing that apt-get, yum, and pacman/yaourt are nice. Just talking about how awesome OpenBSD is.)

protomyth 14y ago

So far so good on this upgrade. Like all the recent versions I would seriously look at the changes to pf.conf. It seems like taking advantage of some of the new stuff would be in order. Also, smtpd seems to be coming along nicely.

agallego 14y ago

I wish I could go back to using it but I currently have to do some GWT dev and they only officially support linux. I tried running a vm and dual boot but that was too much hustle... as soon as I'm done with this project I'll go back to this distro. :)

thisisstupid 14y ago
OpenBSD isn't a 'distro'. It's a distro in the same sense that Windows is a distro.
drhowarddrfine 14y ago
The BSDs do not have "distros". That's a Linux-ism.

throwaway64 14y ago

one thing to definitely watch in OpenBSD is their new mail daemon, OpenSMTPD. It has a configuration syntax that is about 100x easier to setup and understand than anything else out there, although they are still working to get it up to par feature wise. The code is also written with a heavy focus on security, correctness, and simplicity. Its definitely something to watch for all those hackers that want an alternative to gmail that isnt the insanity of a postfix/qmail setup. listen on em0 map aliases { source db "/etc/mail/aliases.db" } accept for local deliver to mbox accept for all relay Thats all you need for a working mail setup :) http://opensmtpd.org/ http://opensmtpd.org/

emillon 14y ago
> accept for all relay If this defines an open mail relay, please think twice because your machine may be used to send spam and get blacklisted.
- poolpOrg 14y ago
  nope, by default rules have "safe" implicit behavior: accept for all relay -> accept from local for all relay to create an open relay one has to explicitly: accept from all for all relay
KonradKlause 14y ago
Let's hope that it does not end like: http://www.opencvs.org http://www.opencvs.org
- peteretep 14y ago
  How did that end?
  - KonradKlause 14y ago
    "OpenCVS is to be released soon." since 2004
- 14y ago