OpenBSD 5.7 highlights

http://www.tedunangst.com/flak/post/OpenBSD-57-highlights

by smhenderson • 11 years ago

78 31 11 years ago

ghshephard2• 11 years ago

That is one incredibly annoying web site.

[edit - it stops after a while]

Regarding: "The etc sets are now gone. All the sample /etc files are now included in the base set. This should make sysmerge must [sic] easier and faster in the future, since there will be many fewer conflicts to resolve. On the other hand, even rc and rc.conf are now overwritten, so it’s not possible to maintain local mods without additional work. This makes sense, though, since /etc/rc is as much a part of the base system as /sbin/init. You don’t want to be running a five year old edition."

I thought (and the manpages always indicated) that the rule was that /etc/rc and /etc/rc.conf were fair game, and that if you wanted to make changes that weren't overwritten by a system upgrade, to put them in /etc/rc.local and /etc/rc.conf.local. I'm unclear why this is considered a problem.

peatmoss• 11 years ago

I'm thinking that might be an April Fools design. I've been to his site before and never got the giant animated text-blocking overlays.

smhenderson3• 11 years ago

It is, I read flak as often as Ted publishes something new and I never saw that. Couple that with the fact that Ted loves to rant[1][2] about bad UI design, especially on the web, and it becomes obvious that his latest "feature" will be gone tomorrow.

1 http://www.tedunangst.com/flak/post/the-wiki-box-is-out-of-c...

2 http://www.tedunangst.com/flak/post/no-im-not-running-git

seryoiupfurds2• 11 years ago

Just when you think you're safe,

"Check me out with CVS!"

ams61102• 11 years ago

I interpreted it as "illustrating absurdity by being absurd."

seryoiupfurds2• 11 years ago

I thought (and the manpages always indicated) that the rule was that /etc/rc and /etc/rc.conf were fair game, and that if you wanted to make changes that weren't overwritten by a system upgrade, to put them in /etc/rc.local and /etc/rc.conf.local. I'm unclear why this is considered a problem.

For the most part that's true, but /etc/rc.local is run fairly late, so if you have a sufficiently-crazy setup you might have to edit /etc/rc.

For example, before softraid crypto was integrated into the bootloader I modified /etc/rc to prompt for the keyphrase before it tried to mount the disks.

ghshephard2• 11 years ago

Understood - but, at least you have been forewarned by the man pages, that any changes you've made to /etc/rc are going to have to be carried forward, because after an upgrade, /etc/rc will be wiped and set to the operating system version.

I'm a basic novice when it comes to OpenBSD (But a huge fan), and that, in addition to discovering that you keep all the old versions of every library ever installed when upgrading, where two things that I had been taught - so I presume that the knowledge was universal.

danudey2• 11 years ago

[edit - it stops after a while]

It stopped for me after I closed the window in disgust.

Internet Jackass Day is bad enough on a fundamental level, but when your jackass behaviour gets in the way of people's actual tasks (and there's no way to say 'stop this BS'), you're not being funny.

cbd19846• 11 years ago

It's an April Fools website. That means it, and all of its content, is wrong.

_mikz• 11 years ago

Great marketing! I liked you on facebook.

wglb2• 11 years ago

I think I will wait a day or two, hoping the seriously annoying pop-over is gone on April 2.

clarry• 11 years ago

Actually you only need to wait a few minutes. Or use a simpler browser such as links.

wglb2• 11 years ago

Kept coming back.

IE6• 11 years ago

For me it was basically a three second ordeal...

danudey2• 11 years ago

It popped up something which took three seconds to scroll in. Then disappeared. Then when I found my place again it popped up another one. Then it went away, and I tried to figure out where I was on the page. And then it happened again and I closed the window.

wolf550e2• 11 years ago

Why is SCSV a sucky feature?

smhenderson3• 11 years ago

I don't know too much about it but it's a LibreSSL compatibility feature to stay compatible with OpenSSL. Basically it's a mechanism for client software to fall back to reduced encryption when better options fail. Considering their stance on security I can see why the OpenBSD guys look at this as a bad idea. But on the other hand if they want people to adopt LibreSSL some "compatibility over maximum security" choices have to be made.

More here... https://github.com/libressl-portable/portable/issues/36

wolf550e2• 11 years ago

It's not a way to fall back, it's a way to detect fallback and prevent downgrade attacks.

https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-05

A client sends a ClientHello trying to connect with TLS 1.2, MITM does not let that through, the client sends a ClientHello for TLS 1.0 with a signal that means "this is a fallback", the MITM lets that through, the server sees this and does not allow a connection, foiling the attempted downgrade attack.

I know that, that's why I asked: "Why is SCSV a sucky feature?".

ams61102• 11 years ago

Interesting in that "want people to adopt" has never been a stated objective for OpenBSD that I've seen. It's more like "we build what we're interested in, and if it solves a problem for you too, that's great."

zumtar• 11 years ago

My UX - click,ugh!,back.

cauterize2• 11 years ago

According to http://www.openbsd.org/57.html "IPv6 router solicitations are now sent by the kernel ("inet6 autoconf"); rtsol(8) and rtsold(8) are no longer necessary and have been removed."

Does this mean we might finally get IPv6 and DHCP support enabled by default? Currently dhcpd does not support IPv6

marios• 11 years ago

IPv6 is not enabled by default. It is compiled in the kernel, but interfaces don't get an IPv6 link-local address if you don't explicitely say so. When you enable IPv6, you get a link-local address, send router solicitations and process router advertisements ("IPv6 autoconfiguration"). Router advertisements carry the prefix information, and the gateway address, as well as a DNS resolver. The latter is not always processed. It does not happen on Windows 7, on Linux you need to install rdnssd and I'm fairly sure it's the same case with the various BSDs.

Sometimes, this is not enough to get global IPv6 connectivity. The router advertisement has a flag that can indicate that the host must/can request additional information through DHCPv6. While similar to DHCP, DHCPv6 is quite a different protocol; therefore you need a separate client (or you need to merge it in your DHCP implementation; much like ISC's dhclient does with the -4/-6 command line flag).

So no, OpenBSD ships with IPv6 support as well as DHCP support. it's just that IPv6 is not configured by default, and IPv6 and DHCP have little to do with each other.

cauterize2• 11 years ago

Thank you for the clarification.

cbd19846• 11 years ago

The site is a possible seizure trigger.

cbd19846• 11 years ago

Flagged as seizure trigger.

cbd19846• 11 years ago

If the person is engaging in April Fool stuff, we obviously can't take any of this information seriously anyway.

cbd19846• 11 years ago

This is obviously incorrect, and a seizure trigger to boot.

slasaus• 11 years ago

I really like the support for tls in syslogd. Unfortunately it looks like it is not yet supported server-side. At least in current, syslog.conf(5) doesn't mention anything about specifying a private key.

cbd19846• 11 years ago

This site is still totally unreadable.

OpenBSD 5.7 highlights

Related Stories