OpenBSD Innovations

https://www.openbsd.org/innovations.html

163 63 3 years ago

Even if you're not an OpenBSD user, it's always good to see just what sort of innovations they (and the other BSDs) are regularly coming up with to solve all sorts of operating system problems, audit code, and improve security and performance.

nesarkvechnep4• 3 years ago

It was discouraging to realise that I don’t know anyone who at least has tried a BSD.

scrapheap• 3 years ago

You can always give it a try yourself :)

owenmarshall3• 3 years ago

One of my biggest knowledge gaps was networking, so many years ago I bought a little single board computer and committed to learn OpenBSD & roll my own router.

I learned a ton, and definitely recommend this as the next step for someone who installed a BSD in a VM and is intrigued.

MobiusHorizons3• 3 years ago

I decided to try it out on my laptop sometime in 2020. I really enjoyed using it in the terminal, but found it less usable in desktop environments (I used gnome shell). It was certainly usable, but less refined that I had hoped.

Then I installed FreeBSD on an arm based sbc I use as a server and NAS. It has been a joy to use there. Basically rock solid, and the scheduler seems to prioritize interactive processes so that even under heavy load I can diagnose what’s going on quickly. I now prefer it to Linux in shell environments. I also have openBSD on a thinkpad laptop, which has been fun

eddieroger• 3 years ago

I've tried it, including running it as a VM for a while with the hopes of using it more, feeling like I was missing out on something. It is different than what I am used to with *nixes, and for my interests and efforts, I just haven't had the time to sit and make it work for my needs as well as something like Debian does out of the box. If you use macOS, you're using a cousin of BSD, if that scratches an itch.

UnixSchizoid• 3 years ago

As a sysadmin, they are 100% better in a server environment. Desktop usage takes more tweaking and time to get working but will work eventually. I used Open and Free BSD as my main os on my Dell Latitude until I found nixos

nerdbert• 3 years ago

We ran FreeBSD on a few racks full of highly used web servers (and some auxiliary servers) from 2000-2012.

I liked it because it was rock solid and configurations were simple and straightforward. It also made some things, like read-only bind mounts, easier than Linux did at the time.

However we finally gave up because the update/upgrade process was a big pain compared to Debian so it was harder to schedule updates, and because it was hard to find people who were familiar enough with it to take anything off my plate.

Now only using it for firewalls. Everything else on Debian linux which is slowly getting more annoyingly opaque with stuff like systemd that infuses magic and binary-format logs and stuff into things that used to be easy to debug. Who knows, maybe we'll be begging it to come back into our arms again one day.

squarefoot2• 3 years ago

BSDs may not have a significant presence on desktops, but they're well known in the networking world for their reliability. They also were the foundation used to build OSes for specific applications. OpnSense and XigmaNAS, for example, are two excellent FreeBSD based applications aimed at firewalling/security and NAS/services.

https://opnsense.org/

https://xigmanas.com/xnaswp/

guerrilla• 3 years ago

This could mean that you need to expand your social circle. To be clear, I'm not saying it's common just that that might benefit you.

accrual2• 3 years ago

I'm the only OpenBSD user I know in person. But I'm okay with that because it's my favorite OS and makes me happy. :)

teddyh2• 3 years ago

This is a list of software and ideas developed or maintained by the OpenBSD project

(Emphasis mine.)

nullindividual5• 3 years ago

CARP is probably my most favorite innovation from OpenBSD. It is a direct competitor to the closed Cisco VRRP and I find it to be easier to use than Linux' Keepalived (I'm assuming this came out post-VRRP licensing?).

skullone• 3 years ago

One funny thing, CARP on the same L2 segment can cause funny things to VRRP nodes - they're that similar :p

nullindividual5• 3 years ago

One protocol has the patent bit set to 1 while the other is set to 0.

throw73• 3 years ago

Yep, they're the same protocol number 112, so they conflict. In things like wireshark, you'll want to change to the carp dissector.

teddyh2• 3 years ago

<https://www.openbsd.org/lyrics.html#35>

nullindividual5• 3 years ago

No way, that was great! Thank you for sharing.

This is a Cisco HSRP patent document with the word "Cisco" crossed out and the word "IETF" written in crayon.

That one got me.

chaxor• 3 years ago

I see this when poking around on routers and such, but I always wonder if it is useful or common to see for consumers. Is this something that only ISPs will implement? Or is it closer to the acceptable self hosted solutions like running pihole? It seems only useful for like 0.1% of the year if something goes very wrong? I don't think I have understood it enough to know why I might even be interested in using it.

nullindividual5• 3 years ago

High availability isn't 'useful' or 'common' to consumers [home equipment]; consumer-class ISP services would generally be incompatible with highly available routers (dual WAN/ISP on a single router is going to be more common).

I used CARP for HAProxy in lab environments, but that is as 'close to home' as it got.

CARP is useful for any time you need to take a service down residing behind CARP. Updating an HAProxy box, for example. Failover/disable the node you'll be performing maintenance on, which is >0.1% of the year.

DrPhish• 3 years ago

I'm an OG OpenBSD user (literal 386 firewall) so I've been using it at home since before CARP was released.

When the first CARP release hit I immediately set it up on a pair of SUN Ultra1 pizza boxes I had gotten on eBay after the .com crash (with a third cold-spare) and ran that way for years. My ISP even called me at one point to find out what "those weird mac addresses" were on the SUN hardware.

They, of course, ended up being too power hungry and I moved to PC-Engines Alix boxes. When I wanted more horsepower as my internet speed increased, I moved first to a pair of PC-Engines APU boxes, and now to one APU and one virtualized OpenBSD firewall.

CARP has always been rock solid throughout, both on the internal and external interfaces of my firewalls. Rolling reboots for patches, updates, OS upgrades or hardware failures are a non-issue. No one in my family ever notices. Combine that with multi-homed ISPs and the internet at my house is more solid than a lot of enterprises and there's no expensive hardware or software involved.

I guess that was a long-winded way to say: Home consumers CAN benefit from high availability! It just isn't packaged in an easy to use or cheap enough form factor for them.

throw73• 3 years ago

ucarp is carp on linux. It's what I use on linux.

nullindividual5• 3 years ago

Is this still maintained? The pureftpd.org link is dead and the GitHub repo is archived.

https://github.com/jedisct1/UCarp

gottorf• 3 years ago

For what it's worth, I run into weird CARP issues every now and then with 7.1. Stuff like both machines thinking they're master, or a down machine not triggering failover in the secondary. Always seems to be worse with the multiprocessor kernel.

It's one of those problems that don't happen often enough for me to really spend time debugging, but is annoying nonetheless.

linsomniac• 3 years ago

~5 years ago I decided to use keepalived as a simpler high availability. It's got a lot of weirdness that I've had to work through and around, largely related to services running on the nodes. In the end my conclusion was that it wasn't really simpler than corosync+pacemaker, so I'm switching back.

ntfAX• 3 years ago

When memory safe programming language?

accrual2• 3 years ago

On OpenBSD? I don't think it will happen any time soon. The developers seem pretty happy with C and instead enforce a strict code style, commit reviews, and auditing. There was a user on the lists a while back also running some static analysis and submitting bugs (moon-something, sorry, it was years ago).

bandrami• 3 years ago

Conceivably when the current team is retired and a different group of people with a different set of priorities takes over.

mikem170• 3 years ago

Here's Theo's response on integrating safe languages into openbsd, circa 2017: https://marc.info/?l=openbsd-misc&m=151233345723889&w=2

To summarize: He mentioned a lack base posix utilities in these languages (posix compliant utilities), and that changes like this take a long time (stack protector took 10 years to implement), and that these new toolchains would dramatically increase build times (like haskell cgrep vs openbsd grep), and that openbsd requires that base can build base on all platforms and some of these languages won't work on some supported platforms (there wasn't enough address space on i386 for rust to compile itself, for example).

I realize some of this may be dated by now, but I assume the above are the types of concerns they would want to address.

rollcat• 3 years ago

The impact of AnonCVS is probably understated. Github was 2008. Remember SourceForge? It's easy to forget how casually browsing commit history was just not a thing.

chungy• 3 years ago

I likewise remember maintaining svnsync mirrors to have locally-browsable subversion history. Not only was it faster, but it also meant I could work offline. At least until I had to sync up my local commits to a remote server, oh boy that's a pain I had long forgotten.

There's very good reasons Git won, this is among them.

patrec• 3 years ago

You say innovations, I say counterproductive bullshit. The idea to write a "secure" operating system on the basis of a) C, the single worst and most actively anti-secure language in the history of computing b) unix with its ambient authority/everything is global and myriad of other design flaws is just fucking crazy and about as helpful as efforts to "fix" cattle slavery by tinkering with the design of whips and chains to make them more humane.

So which of these layers upon layers of crap actually really, fundamentally fixes any of the core underlying problems (like using, in 2023, a memory unsafe language full of UB footguns to implement network facing services and not having the semblance of a proper security model)? Rather than just making them incrementally harder to exploit at the cost of ever increasing complexity and overheads that also get imposed on saner technologies which do not suffer from these problems in the first place?

How much faster (never mind secure, simple and robust) would our core computing infrastructure actually be if not everything was organized around a quixotic quest to partially mitigate some insane design decisions of C and the fact we're using a half-century outdated OS design?

nazgulsenpai• 3 years ago

I rather like OpenBSD. I find its simplicity and modularity to be a positive, and personally I find it much easier secure a system that I fully understand. Plus its liberal license and open source nature makes it easy for anyone to fully audit the entire system.

And if you don't like OpenBSD, you can use something more secure, made with modern safe language or whatever it is you expect an OS to be.

beachhead• 3 years ago

what's cattle slavery? we talkin dairy cows or what?

gumballindie• 3 years ago

So many good open source operating systems out there yet nearly all suffer from lack of drivers. I think there should be legislation forcing hardware manufacturers to open source all of the code needed to run their products. Not doing so prevents users from using them as they see fit, and are instead limited to low quality products such as windows.

Imagine if as a result all hardware would he compatible with all os’. Suddenly openbsd, freebsd and linux distros would be dominating the desktop.

bjoli• 3 years ago

That random relinking at boot is such a simple and elegant way to make things harder for an attacker. I would like to think I could have come up with it myself.

OpenBSD Innovations

Related Stories