OpenBSD 5.6: What will be there

http://www.openbsd.org/56.html

by lelf • 12 years ago

104 80 12 years ago

peatmoss3• 12 years ago

Can anyone speak to SSD in OpenBSD? My understanding is that trim support is not supported in OpenBSD (http://daemonforums.org/showthread.php?p=51377). That makes me a little worried about the potential to wear out an SSD drive in a workstation. The thread I linked discusses reducing some writes by using softdeps and the like, is that enough to make this a non-issue?

dmm3• 12 years ago

In general I wouldn't trust random forums for information about OpenBSD. People tend to repeat stuff long after its true. Send a message to misc@ or tech@openbsd.org and you'll hear directly from the devs.

Just make sure your partitions are 4k aligned to minimized write amplification. Many openbsd devs use SSDs. I've used one with openbsd for years without problems. Honestly it's a requirement given the shortcomings of ffs.

peatmoss3• 12 years ago

I've been away from OpenBSD for a while, and was just googling to try to get a starting basis. Thank you for pointing me to the 4k alignment issue. This thread (http://openbsd.7691.n7.nabble.com/SSD-disk-alignment-td75046...) seems to suggest that OpenBSD will try to align to 4k boundaries by default. Is that correct?

cylinder714• 12 years ago

Here's a link to the FAQ section regarding flash memory:

http://www.openbsd.org/faq/faq14.html#flashmem

There's no mention of the 4K alignment issue, however.

g047f4c33• 12 years ago

Some info regarding TRIM, http://www.tedunangst.com/flak/post/lessons-learned-about-TR...

For the moment, just make sure you leave a slice of the SSD unused. You could also on occasion backup the OpenBSD install, replace it with an empty ext4fs and fstrim it via a livecd, then restore the OpenBSD install.

ancarda• 12 years ago

IPv6 is now turned off on new interfaces by default. Assigning an IPv6 address will enable IPv6 on an interface.

Why?

Zenst• 12 years ago

Off by default makes much sense given it is another vector to attack. If not needed then why be on and more likely to just use IPv4 over even touching IPv6.

andreasvc5• 12 years ago

Not just a vector of attack, it also causes performance and connectivity problems when misconfigured. As long as there is no critical mass for IPv6, it's not worth the headache. I know that if everyone had that attitude, IPv6 will never get critical mass, and that is exactly what I'm rooting for. I don't care for toasters with IP addresses.

danielweber2• 12 years ago

Of the two remotely exploitable OpenBSD holes in the default install, one was from IPv6. But it was ~7 years ago, so it's weird that they waited until now to turn it off by default.

chrissnell• 12 years ago

I used to use OpenBSD extensively in my job because of the awesomeness of PF but later moved on to big iron F5 and Cisco gear. In this new age of NSA wiretaps and cloud based services built around advertising and tracking however, OpenBSD feels more relevant than ever. I'd like to give it a shot as a desktop again.

So, who makes a modern laptop with good OpenBSD hardware compatability?

peatmoss3• 12 years ago

Was thinking the same thing myself. I keep thinking recent MacBook Airs would make a good candidate--reasonably standard Intel hardware, decent components, tons of systems in the wild. Hence my comment about trim support for SSDs.

sudowhodoido5• 12 years ago

Try FreeBSD if you want TRIM. Also has LLVM, PF and ZFS out of the box.

dmm3• 12 years ago

All of the openbsd devs use thinkpads and they have good compatibility in my experience. The newest ones might have UEFI and they might not work well.

CoconutPilot• 12 years ago

I heard this and installed OpenBSD on my thinkpad only to find out there is no support for nVidia. I suppose you need ATI or Intel video to get a working X.

There is a brief warning about nVidia here: http://www.openbsd.org/amd64.html

sudowhodoido5• 12 years ago

Lenovo X201 works well. Not exactly modern but a nice machine and more than adequate.

seryoiupfurds• 12 years ago

T420 is great too, so long as you have Intel graphics and wireless.

eropple3• 12 years ago

Caveat laptopor. I installed OpenBSD on my X201 just to give it a shot, and the battery life is atrocious.

Alupis2• 12 years ago

moved on to big iron F5 and Cisco gear.

Just pointing out that this is a perspective thing. PFsense and similar can very-much-so be just as "big iron" as Cisco et al.

tomasquintero• 12 years ago

ASICs start to play a big role at scale. To me the phrase "big iron" signals towards them.

atmosx• 12 years ago

On a laptop I'go with linux any day. I don't feel like any BSD was/is intended to be run on laptops, not if you don't wanna lose time in extensive configuration to make everything (almost) work.

clarry2• 12 years ago

That is a weird feeling you have.

If it wasn't intended to be run on laptops, why do most OpenBSD devs run it on their laptops? Why does it have graphics drivers with LVDS output? Touchpad support? Why does it have X with multiple window managers and OpenGL with 3D acceleration? KMS? ACPI suspend & hibernate? Sound daemon? Disk encryption?

There are a lot of features that make mostly (only?) sense on laptops, and the developers spend a lot of effort to make sure it works. It'd be absurd to claim the system is not intended to run on laptops.

I've run OpenBSD on my netbook for years. And it works pretty damn well, right out of the box.

g047f4c33• 12 years ago

It works like a charm on any intel i-series CPU with integrated intel HD graphics and most intel wireless chipsets (excluding the newer AC* versions).

I use it exclusively on servers, and on all laptops/desktops I use for real work. Its a breath of fresh air! No bloat, no evil, gets the job done - Not to mention some lovely features such as Full (no unencrypted boot slice) disk encryption via softraid, a completely unprivileged X server (with KMS supported GPUs), and a brilliant set of simple and solid daemons included in the base system.

The only time I'll switch away is to use linux - The two reasons there being 1) High-end Gaming, 2) Virtualization.

jingo• 12 years ago

"IPv6 is now turned off on new interfaces by default."

I have had to remove the IPv6 option from my kernels because enabling IPv6 by default (which to me seems like a "policy" decision) has become so pervasive. Nice to see this change; here's hoping other OS's follow suit.

cbd19843• 12 years ago

I can understand not supporting tape installation (although aren't tapes still used in large, serious, high-power businesses as backup media?), but why remove FTP? Granted, it's objectively a horrible protocol, but is the FTP client code more likely to be an attack surface than the HTTP client code? If you're after security, isn't it more secure to remove all network installation and force people to use only physical media which they obtained from a secure and trusted source?

http://mywiki.wooledge.org/FtpMustDie

danielweber2• 12 years ago

That surprised me, too, because in 2013 I was installing from FTP. But mostly from habit.

I'm hoping it's because they are going to be using HTTPS with pinned certs to ensure you are downloading from a proper mirror. But that's hope, not actual knowledge.

cbd19843• 12 years ago

HTTPS with pinned certs

Is there an FTP equivalent of this?

justin66• 12 years ago

I can understand not supporting tape installation (although aren't tapes still used in large, serious, high-power businesses as backup media?)

How does removing tape installation as a feature affect businesses who use tape as a backup method?

cbd19843• 12 years ago

My point is that tape isn't dead, that it's still a viable way to store large amounts of data, like a full OS install with lots of ports to go along with it.

itwontdie• 12 years ago

"Major internal refactoring to begin to make part of OpenSSH usable as a library. So far the wire parsing, key handling and KRL code has been refactored. Please note that we do not consider the API stable yet, nor do we offer the library in separable form."

This is intriguing. I would certainly like to know more about what is happening with this.

ams61103• 12 years ago

MS-CHAPv1 (RFC2433) support has been removed from pppd(8).

This is sensible but means I can't use OpenBSD to connect to one of my client's VPNs. Unless there's another way?

inopinatus2• 12 years ago

Untried, but you may be able to just recompile pppd with different options; the diff seems small.

http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/pppd/M...

Worst case scenario you'd have to restore some bits of old source (chap_ms.c and maybe the necessary md4 routines).

s800• 12 years ago

Everything 68k is gone?

ams61103• 12 years ago

Where does it say that?

Edit: If you mean mac68k then yes, but that platform was dropped after the 5.1 release. http://www.openbsd.org/mac68k.html

kjs34• 12 years ago

HP300 and MVME68K are 68K. I occasionally crank up the latter for shits and grins, but support is far more a labor of love than for any utility these platforms might have left. See also: VAX.

sigjuice• 12 years ago

Should information like this be provided over an insecure HTTP connection?

    signify(1) pubkeys for this release:
    base: RWR0EANmo9nqhpPbPUZDIBcRtrVcRwQxZ8UKGWY8Ui4RHi229KFL84wV
    fw: RWT4e3jpYgSeLYs62aDsUkcvHR7+so5S/Fz/++B859j61rfNVcQTRxMw
    pkg: RWSPEf7Vpp2j0PTDG+eLs5L700nlqBFzEcSmHuv3ypVUEOYwso+UucXb

vinceguidry2• 12 years ago

Public keys are intended to be public. So long as you're not transmitting them over the same connection as the one you're using them in, you're golden.

dbpatterson• 12 years ago

The point of HTTPS is not to hide things, it's to prevent tampering... Which seems relevant when transmitting checksums.

Sir_Cmpwn• 12 years ago

Eh, I think it's fine. I advocate for HTTPS everywhere but I don't think this particular bit of information is so sensitive as to demand encryption.

marktangotango• 12 years ago

http://en.wikipedia.org/wiki/Public-key_cryptography

lern_too_spel• 12 years ago

No.

Now you've learned a valuable lesson about asking a rhetorical question on the internet. None of the other responders knew the correct answer.

brunoqc• 12 years ago

I wonder if I should wait for usb storage support on Octeon or if I should just buy a Soekris. It's for home, nothing big.

bluehazed• 12 years ago

Love the release song for this one.

tedunangst• 12 years ago

Why submit this now? The fact that the top item is "..." wasn't a hint it's not done?

jamesaguilar• 12 years ago

Fascinating that they removed the agp driver.

skz• 12 years ago

Does anyone know off the top of their head how OpenBSD performs on a Samsung 900X?

tbrock• 12 years ago

Order a CD rom? Talk about out of touch, ouch.

doomrobo• 12 years ago

I think for companies that still do this, they acknowledge that the impetus for buying a CD is more for collection/novelty purpose than actual usefulness. My question is whether there are any more effective ways of generating some kind of profit that actually involves giving something extra to the user, whether physically or digitally.

g047f4c33• 12 years ago

http://www.openbsd.org/faq/faq3.html#BuyCD

Not to mention another verifiable source for the signify keys.

rakoo• 12 years ago

They do need money, that's a way to give them some.

enjoy-your-stay• 12 years ago

Does anybody know why they are dropping support for kerberos?

I didn't even know there was support for Kerberos in OpenSSl, but it's also under the LibreSSL bullet points as well.

clarry2• 12 years ago

Nobody uses it and it's a lot of code to audit.

  Log message:
  Remove SRP and Kerberos support from libssl. These are complex protocols
  all on their own and we can't effectively maintain them without using them,
  which we don't. If the need arises, the code can be resurrected.

Or in Theo's words:

  It is crap.  Eventually we recognize the risk is to high.

Another relevant commit message, with a fun quote:

  Log message:
  The complexity and quality of kerberosV and the fact that almost
  nobody is using it doesn't justify to have it in base - disable and
  remove it.  If the 2 two people who use it still want it, they can
  make a port or recompile OpenBSD on their own.

  There is a quote in theo.c from August 2010: "basically, dung beetles
  fucking.  that's what kerberosV + openssl is like".

  Discussed with many.  Tests by henning@ reyk@ and others.
  ok deraadt@ henning@

I recommend you take a look at the whole message, it'll give you a vague idea of how big the code base was. Keep in mind that this particular commit was followed by a lot of smaller commits removing remnants of kerberos that had kinda spread all over the system...

http://marc.info/?l=openbsd-cvs&m=139816103911227&w=2

OpenBSD 5.6: What will be there

Related Stories