OPNsense and HardenedBSD are parting ways

https://forum.opnsense.org/index.php?topic=22761.msg108313#msg108313

by zdw • 5 years ago

75 49 5 years ago

forum.opnsense.org

koiwacandy• 5 years ago

Wouldn't OpenBSD a better choice than either FreeBSD or HardenedBSD if security is a focus? It also has better wifi support and a much more modern PF firewall. OpenBSD is really "the" router OS. It makes a lot more sense. (no pun intended)

adamcstephens• 5 years ago

Perhaps, but is different enough that it would be a significant migration cost.

cmeacham982• 5 years ago

OpenBSD security is overstated in my opinion (and the opinion of others[1]), and I have serious doubts it would be worth the work to migrate to unless FreeBSD is absolutely terrible.

1: https://isopenbsdsecu.re/quotes/

_joel• 5 years ago

Intigued as to why you think it's overstated. It seems pretty robust to me. Those quotes are fairly snipey and there's quite a bit of history behind the people to bias their opinion.

Covzire• 5 years ago

They're like the raspberry pi's of OS's, great to tinker with and great to use if you have a use case that fits it. The main focus of OpenBSD's security seems to be a low attack surface and slower adoption of certain things. The network stack is still single-threaded for example. It's great for a home firewall but their philosophy is pretty paranoid and slow moving to the point where they're great for what they are but not very useful in any actual commercial data centers.

tptacek3• 5 years ago

It's interesting that OpenBSD's security reputation is such an article of faith that this comment is light-grey now. I get that it's not supremely substantive, but "OpenBSD's security is overrated" is not a controversial statement in the software security community. They built their reputation on the 1990s OpenBSD security audit, which was a real innovation, but one that every other mainstream operating system has since picked up. Linux probably gets substantially more audit attention now than OpenBSD does, and is quicker and more open to deploying kernel countermeasures. I'd probably trust a minimal Linux distro with a decent kernel configuration more than I trust OpenBSD.

Later

The comment I'm responding to isn't light grey anymore; the perils of flouting the guidelines and talking about downvotes! I wasn't objecting to the votes, though, just noting that the C.W. on HN seems different than in specialized security communities.

dleslie2• 5 years ago

I've seen this before and my thoughts on it are simple: ok, so OpenBSD does some silly and archaic things, but where are the exploits?

I keep hearing that the security community has doubts about OpenBSD, but I don't hear about those doubts being validated.

brobdingnagians2• 5 years ago

That site doesn't make a very cogent point and likes quoting tweets of people without substance; just because you have credentials doesn't mean you don't have to make logical points. It does have some criticisms that can be taken account of, though some are obsolete, and they do show that lots of other OSes have security mitigations too (lots of which had them before OBSD), but it really does appear to be written by someone with an axe to grind. If you want the other side, [1][2][3] from the OpenBSD mailing list have some discussion.

From my understanding, OpenBSD is partly a research OS and written by developers for developers. They want other OSes to grow and get better and adopt more security features; I don't get the feeling they are trying to compete with other OSes, but rather cooperate. If you like it great, if not, then you are free to go somewhere else. Linux appears to have a very competitive environment with a lot of toxic power games and the desire to prove that it is the One True OS. The BSDs thankfully have less of that; I use Linux, BSD, Windows, and Mac OSX. I like all of them for different reasons; I hope they all continue to improve. There is room enough for all.

[1] https://marc.info/?l=openbsd-misc&m=158906273407900&w=2

[2] https://marc.info/?l=openbsd-misc&m=158897658715925&w=2

[3] https://marc.info/?l=openbsd-misc&m=158886904708799&w=2

ShroudedNight2• 5 years ago

Since Shawn has been a core team member due to the involvement into our operating system, we decided to remove him from our core team as well.

I am but an ignorant bystander, but the way this is phrased, it sounds like a quorum of OPNsense leadership unilaterally closed ranks against someone who likely had significant emotional investment in the project, and did so specifically after determining that they had extracted the maximum value they could from them.

As written, it sounds deeply unempathetic and, at least for me, actively fosters a desire to see the project burn, replacing the blossoming curiosity I had prior.

Is this just badly worded?

Arnavion2• 5 years ago

From #OPNsense on freenode, after the forum post was posted this morning:

    <> fitch: But I really do hope the parting is on good terms with lattera
    <@fitch> no, we are cool. obviously it's not a short term decision that breaks everthing next week. For the rest of the year this doesn't change much
    <lattera> yeah, we're on good terms. I'm somewhat disappointed, but I understand
    <lattera> once opnsense switches to fbsd, I'll likely migrate to bare hbsd on my firewalls

(fitch is Franco Fichtner. lattera is Shawn Webb.)

ShroudedNight2• 5 years ago

Thank you, that seems reassuringly friendly in the presence of philosophical differences. It's heartening to hear.

Panino• 5 years ago

Over time we have seen that building on top of HardenedBSD not always guarantees interoperability,

It sounds like interop was the deciding factor here. Without speculating, does anyone know details? What kinds of issues were difficult to resolve on HardenedBSD compared to FreeBSD?

Arnavion2• 5 years ago

From #OPNsense on freenode, after the forum post was posted this morning:

    <> > issues we or our users run into are not always very widespread and have the tendency to complicate tracking issues
    <> ... what issues? is this kernel, base, or packages?
    <@fitch> https://github.com/opnsense/ports/issues/95 https://github.com/opnsense/src/issues/91 https://github.com/opnsense/core/issues/4263 are just three of those

vermaden• 5 years ago

Not sure a great move here.

HardenedBSD have some additional security mechanisms that vanilla FreeBSD does not have:

https://vermaden.wordpress.com/2018/04/06/introduction-to-ha...

tachion2• 5 years ago

One of very important reasons why FreeBSD haven't incorporated the patches from HardenedBSD was that their code quality was disputed and historically the author had issues with undergoing reviews and applying requested changes. HardenedBSD may do a very good job for the PR about their "superior security" but one may wonder if a system without badly implemented feature isn't more secure than the one with it.

that_guy_iain• 5 years ago

the author had issues with undergoing reviews and applying requested changes.

Does this mean the author would send code for review and never actually action the change requests? Or was it more they sent patches and expectecd them to just be merged?

egberts1• 5 years ago

My take as an infrequent BSD OS analyst but a lifelong Linux OS analyst is that this is a GRSecurity redux.

Sad case of landmass breaking off into an island with a much smaller ecosystem befitting only the current biodiversity (or should I say, cyber-diversity).

OPNsense and HardenedBSD are parting ways

Related Stories