EU study recommends OpenBSD

http://undeadly.org/cgi?action=article&sid=20150427093546

by fcambus • 11 years ago

352 150 11 years ago

s_dev3• 11 years ago

Theo De Raadt always complained that many of the institutions that run and use OpenBSD don't contribute back. Good to see the EU at least acknowledging that its something that they should explore. They probably use it and its features more than they realise.

I suspect there is a strong political motive as well behind being "technologically independent" after the NSA mass surveillance revelations.

I like the sound of an EU BSD fork - hopefully they fund one. We've always been lacking in the Operating Systems dev department over here in Europe. Linux is our main contribution but we can do more.

jkyle5• 11 years ago

Theo De Raadt always complained that many of the institutions that run and use OpenBSD don't contribute back.

Sounds like he needs a different license then.

joshuapants• 11 years ago

I don't think that would make them likely to contribute back, they'd just use something else. He'd rather have selfish people using good software than choosing to use something inferior.

tbrownaw• 11 years ago

I don't think any of the free/open licenses require users to contribute to the parent project. I don't think any even require that people distributing modified versions, send those modifications back upstream.

weland2• 11 years ago

More often than not, he wasn't referring to contributions in the FSF sense (i.e. people modifying code that they don't send back to the original authors). He simply meant that many of the institutions that run and use OpenBSD, which is available entirely for free, don't give anything in return - be it in the form of code, money, documentation or promotion. Another free license solves only a small proportion of this problem.

giovannibajo1• 11 years ago

TBH a single organization adopting and customizing a GPL software for internal usage isn't forced to contribute back, as GPL affects redistribution not adoption.

istvan__2• 11 years ago

Easy like that?

pyre2• 11 years ago

As we've seen with GPL'd code, many companies are happy to skirt the license restrictions if they feel that they can get away with it. How much money and effort would then need to be expended to enforcement of said new license for OpenBSD? How many companies would do a cost/benefit analysis of the likelihood of OpenBSD lawyers suing them, and even then ignore the license if they thought that it would be less expensive to risk a lawsuit?

"Change the license" isn't a silver bullet. Companies aren't machines that are fed licenses that they then obey like punch cards into an old IBM machine.

zkhalique• 11 years ago

Actually what he said was:

GPL fans said the great problem we would face is that companies would take our BSD code, modify it, and not give back. Nope—the great problem we face is that people would wrap the GPL around our code, and lock us out in the same way that these supposed companies would lock us out. Just like the Linux community, we have many companies giving us code back, all the time. But once the code is GPL'd, we cannot get it back.

hobarrera4• 11 years ago

The only licence that will fix this is one that requires payment from users, and that's never going to happen.

Things like GPL don't force users to send back contributions unless you redistribute a derivate product (which is not usually the case). Theo is talking about giving something back (an acknowledgement, or even better, money).

belorn3• 11 years ago

"said the great problem we would face is that companies would take our BSD code, modify it, and not give back. − Nope. We have many companies giving us code back, all the time." - Theo De Raadt

dimitar• 11 years ago

If so, then the issue is they don't contribute money?

s_dev3• 11 years ago

You could have easily taken the full quote -- it's not quite the contradiction you're trying to make:

"GPL fans said the great problem we would face is that companies would take our BSD code, modify it, and not give back. Nope—the great problem we face is that people would wrap the GPL around our code, and lock us out in the same way that these supposed companies would lock us out. Just like the Linux community, we have many companies giving us code back, all the time. But once the code is GPL'd, we cannot get it back."

th0br04• 11 years ago

In general, the EU is _very_ strong on open source commitments. Almost all projects that I know of and some of which I'm working on funded as part of FP7 (Seventh Framework Programme) will eventually end up open-sourced.

ersii• 11 years ago

Interesting! Could you elaborate some more and perhaps list a few projects, if you're allowed to?

OJFord• 11 years ago

"the EU is _very_ strong on open source commits."

Had to re-read a couple times to get that right -_-

javert• 11 years ago

an EU BSD fork

Why fork it? That is completely stupid. Do you want to have the EU version of North Korea's Red Star Linux? Do you want to make it so Google doesn't work properly on EU BSD?

madez2• 11 years ago

The EU is not North Korea.

A fork would make sense if the EU puts enough man-power into the project and they don't agree with the current leadership.

reddotX• 11 years ago

minix is/was sponsored by EU http://wiki.minix3.org/doku.php?id=www:documentation:read-mo...

DasIch• 11 years ago

The idea of a EU BSD fork sounds terrible. What needs to happen is government funding for key open source infrastructure projects that require it like OpenSSL, OpenBSD, GnuPG, etc.

hobarrera4• 11 years ago

I like the sound of an EU BSD fork - hopefully they fund one. We've always been lacking in the Operating Systems dev department over here in Europe.

There's no need to fork and split manpower, you can contribute to OpenBSD being in Europe.

tormeh2• 11 years ago

The EU also funds Minix 3 development, though that is more about reliability than security.

masklinn2• 11 years ago

The pypy project also benefited from EU grants early in its history.

cbd19843• 11 years ago

The thing about security is that it touches everything.

Ease of use? If something's hard to use, it's easy to confuse people into doing insecure things. Security issue.

Unreliable? Security depends on predictable behavior, and failure modes are often unpredictable. Security issue.

Proprietary protocol? Even if it wasn't intentionally backdoored, you don't know its real attack surface, because you don't know all of the verbs it contains. Verbs imply actions, actions imply changes of state, changes of state imply the Dark Side... uh, security concerns. Security issue.

Performance? Even aside from timing attacks and simple DoSing, things often behave oddly when pushed to a limit, especially if that limit involves otherwise-hidden race conditions. Security issue.

carussell2• 11 years ago

Not anymore. The money from those grants is gone.

andrewstuart23• 11 years ago

Didn't everyone recommend Linux and Mac OS back when vulnerabilities on these systems just hadn't been discovered (or possibly written) yet?

Make OpenBSD popular, add a ton of devs, and attack value, and I'm pretty sure these problems will repeat themselves.

I think the second study, which briefly names OpenBSD, does a good job of pointing out that technological changes alone are insufficient.

masklinn2• 11 years ago

Well there's the difference that security is basically the core focus of OpenBSD's development, and the project actively researches and updates development practices with that in mind.

cbd19843• 11 years ago

Yes, and a Brinks armored truck is just as vulnerable to carjackings as a Ford Pinto, we just don't know about the vulnerability because nobody drives them.

People were saying the same things about Linux. In the late 1990s and early 2000s. By which time Linux had already become the de-facto go-to OS for web servers around the world. It was, in short, already a high-value target, and yet the apocalypse didn't occur.

andrewstuart23• 11 years ago

Of course that's true. I'm just not convinced that OpenBSD : Linux :: Armored truck : Pinto.

In fact, the point of a good portion of the second study [1], p.17-25 is pointing out the flaws that have occurred in the Linux operating system and other existing technologies.

[1]http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52740...

waxjar• 11 years ago

OpenBSD is already quite popular. It runs on plenty of routers. Routers have very high attack value.

brudgers3• 11 years ago

Link to Part 1 of the study (wherein the recommendation lies):

http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52740...

Part 2 of the study recommends government funding of Open Source Projects:

http://www.europarl.europa.eu/RegData/etudes/STUD/2015/52741...

Potential and actual conflicts of interest between governments and citizens in regard to privacy are not addressed.

k-mcgrady2• 11 years ago

They don't address conflicts of interest but it seems like they're fine with privacy:

"[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance.

They seem to be touting that as a benefit, not a drawback.

brudgers3• 11 years ago

When the same governments are funding signals intelligence gathering with one hand and open source software development with the other, there is potential conflict of interest, if not actual conflict.

The NSA's role in weakening open source encryption standards was the result of the internal logic by which all intelligence organs typically operate irrespective of sponsoring state. The differences between the politics of some EU states and the politics of the US or Russia or the UK don't change that internal logic of intelligence organs. Their job remains to maintain data collection capability.

copx• 11 years ago

Also not addressed: potential and actual conflicts between governments and Theo De Raadt. Remember that OpenBSD used to be funded by DARPA.. used to: http://en.wikipedia.org/wiki/Theo_de_Raadt#DARPA_funding_can...

corv• 11 years ago

The study also recommends Qubes and Tails.

_lce0• 11 years ago

     Nice to see recognition from the trenches of bureaucracy.

It's really nice that they can write such statement.

Kudos to the OpenBSD team!

nbevans3• 11 years ago

"[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts."

That worked great for OpenSSL didn't it? ;)

th0waway• 11 years ago

Yep, the issue was fixed (even though it took a while).

yellowapple12• 11 years ago

And by "a while", one means "a few days after discovery" (a few months after it was introduced, but that's actually not terrible, all things considered).

higherpurpose3• 11 years ago

Microsoft has had 2 Heartbleed-level vulnerabilities in its Windows code so far, that were not just 2-3 years old but 10+ years old, leaving systems vulnerable to them for much longer.

The "advantage" of proprietary code here was that Microsoft got to downplay them (surprise surprise, no scary logo made by Microsoft for them!), and that's how proprietary code owners deal with security issues in general - they try to hide that they exist to keep the illusion that the software is (more) secure.

tptacek4• 11 years ago

This is the second time today you've spread innuendo about how software security teams at big companies handle vulnerabilities, and the second time you've managed to casually insult teams that include some of the best software security people in the entire industry.

Here's the first:

https://news.ycombinator.com/item?id=9445436

These are egregiously bad arguments you're making, involving people who you don't know but that, from my experience reading so many of your comments, I believe are operating many levels above your own comfort level with actual software security.

The trouble is, like me, you comment on HN all the time, and so, like me, you get a huge name recognition boost for these comments you make. People reasonably believe that you know what you're talking about when you "explain" to them how Apple and Microsoft handle vulnerabilities. But you don't, and so these misleading comments prey on their lack of information.

nbevans3• 11 years ago

What on earth is HN sheep's obsessions with making logos for security bugs? This seems to be a very new phenomenon that the young upstarts expect to see when a big bug is found?

This has nothing to do with Microsoft. It is about a false assertion (i.e. OSS peer review leading to less bugs) made so fleetingly that the authors clearly expected it to be accepted by readers as a proven fact. It isn't proven. And I gave just one of countless examples why OSS peer review has proven itself to not necessarily work as one might naively expect it to.

dijit3• 11 years ago

I love openBSD, it's implementation of certain things is slower (like networking), but it's so clean and well implemented.

even if it doesnt' get to play with all the toys (like ZFS) it's what I'd love to default to for application servers/bastion server/firewalls etc;

my only qualm with it currently is it's reliance of X11 for ports to work- I don't like install X11 libs on my servers wherever I can avoid it. :\

adamrt2• 11 years ago

my only qualm with it currently is it's reliance of X11 for ports to work- I don't like install X11 libs on my servers wherever I can avoid it. :\

Can you give a reference to this? I'm not doubting you, as I always install x11 anyway, I just didn't know this was still the case. I remember an issue with a lib in xbase.tgz a few years back that was required by lots of ports, but I thought they moved it to base.tgz.

Thanks!

dijit3• 11 years ago

http://comments.gmane.org/gmane.os.openbsd.ports/54692

http://www.openbsd.org/faq/faq15.html#NoFun (at the bottom of this section)

yellowapple12• 11 years ago

At least with packages, there are "no-X" versions of most packages available (useful if you don't have X on a machine).

dijit3• 11 years ago

the problem isn't that it's dependant for X11 on packages.. moreso that the port system requires X11 to function..

http://comments.gmane.org/gmane.os.openbsd.ports/54692

http://www.openbsd.org/faq/faq15.html#NoFun (at the bottom of this section)

csirac2• 11 years ago

To be fair I have this problem on Debian too. Sometimes there is foo-nox, the foo version without X dependencies, but I seem to find myself building such packages for myself to omit some afterthought GUI bit which drags in Qt, gtk, or half of the gnome universe for no reason.

dash23• 11 years ago

For those that know more about OpenBSD than the EU (and I salute you for it), the EU parliament is a fairly powerless institution. Eurocrats show it little respect; one described it as "just one big fucking NGO".

Update after reading it: this isn't even an official parliament document or recommendation. It's something by the parliament's research service.

makeitsuckless• 11 years ago

On HN, "the EU" is a fictional European entity which can be anything people want it to be depending on the argument they're trying to make.

Excuse the snark, but the wilful ignorance concerning the EU and Europe in favour of ideological posturing makes it near impossible to discuss most relevant topics.

Starting with a somewhat misleading headline doesn't help.

higherpurpose3• 11 years ago

I don't know about that. It's the EU Parliament that comes up with most of the new EU-wide directives. It's the EU Parliament that defeated ACTA, while the EU Commission was trying its best to pass it. The Commission is generally much more prone to lobbying influence, and perhaps unsurprisingly it also tends to be less democratic as a consequence. The new Commission might not be as bad as the previous one, but it's still too early to decide.

madez2• 11 years ago

Between the lines of your comment is a lot of disregard against the EU and the EU parliament. How come so?

pXMzR2A2• 11 years ago

Politicians in EU and US call various institutions a "NGO" when they disagree with it and want to ridicule it to intentionally reduce its public reputation.

EP is a high reputation organization and has force within the EU structure. Calling an EPRS study "something by the parliament's research service" is not only redundant (EPRS = European Parliament Research Service) but also short-sighted (do you do the same thing to the deliverables by your R&D department?).

So, this is an EP study that you can cite in order to support your arguments for switching to free software in your government / school / workplace / home / hobby group.

dash23• 11 years ago

I wasn't dismissing the study's quality, just saying that this is not necessarily going to lead to any change in policy (e.g. all EU computers mandated to run OpenBSD).

progman• 11 years ago

the EU parliament is a fairly powerless institution

This is certainly not true. Thanks to the EU parliament the IT freelancers in the EU don't need to suffer software patents.

The Eurocrats did everything to invent it some years ago, even with dirty tricks (like pushing it through immediately before summer vacation). We IT freelancers contacted politicians of the EU parliament, told them about our concerns, and they actually supported us.

I remember the victory celebration at heise.de (a leading IT newsticker in Germany). Usually there are about some hundred comments per hot thread but in this case it was more than eleven thousands.

toyg• 11 years ago

the EU parliament is a fairly powerless institution.

Nope. The EU Parliament (elected), the Commission (periodically nominated by national governments) and the Council (meeting of national governments) are the three "heads" of the EU political system, and they are locked in a constant struggle to determine the exact boundaries of their powers. The Parliament is the youngest institution, hence the historical disregard of entrenched interests; at the same time, it's the institution most hungry for power, because it's the only one with a clear democratic mandate.

As others mentioned, software patents were a battlefield for such struggle: the Commission repeatedly recommended their introduction (IIRC, at the behest of a certain Microsoft-friendly Irish commissioner), and the Parliament repeatedly sent them packing. You will find several other instances of this happening: the democratic mandate of the EU Parliament in most cases will eventually trump backroom agreements in the Commission, as long as the topic becomes mainstream enough to invoke such mandate.

In future, the institution that is destined to become more and more powerless is one between the Council and the Commission, since their scope overlaps now that the Parliament has taken over the "legislative" process earlier left to the Commission.

erhardm• 11 years ago

I like OpenBSD. I like the spirit of the developers, which don't compromise on security. I like the simplicity of the OS, very good documented and very robust. They are prepared to break a ton of software to advance the state of security/correct code.

I would like to have OpenBSD on all my machines, but unfortunately their license don't have the "infectious" effect of GPL. From my limited understanding, their license[0] is not a philosophical license like GPL. Linux popularity spread because of the distributed development style(everyone developed in their own tree, Linus decided if it had enough value to get in his tree) and GPL.

Even if you don't care on the philosophy of GPL, you can't deny that it helped make a lot of vendors to publish(even if half-hearted) their code which eventually after some cleanup(3rd party or themselves) got into the Linus tree.

If OpenBSD would be GPL licensed, I could see a BSD which would be have all the bleeding edge features, but Theo's tree was separate, conservative on features but not lacking on drivers. Men can only dream.

I realize that FreeBSD is the bleeding edge of BSD land and I'm not trying to start a license flamewar, but a lot of companies, i.e. graphics, wireless cards, laptop manufactures don't have (good) working drivers for BSD land, at least not published code which goes back to the community.

[0] http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/share/misc/lice...

feld• 11 years ago

It depends on what you're after, but in some respects I think Dragonfly and NetBSD are bleeding edge in their own ways (filesystem, VM subsystem, networking)

yellowapple12• 11 years ago

While it's true that the GPL and the distributed nature of Linux development helped GNU/Linux proliferate, that isn't the reason why the BSDs didn't. In reality, they were encumbered by legal problems due to being derivative works of AT&T's Unix; the ensuing legal war of attrition caused a lot of folks to be unsure of whether or not they could legally use any of the BSDs without having to pony up for Unix licenses.

As a result, Linux was created (Linus Torvalds has said that if Hurd existed or if the BSD legality issues were resolved, he wouldn't have felt the need to develop the Linux kernel), and folks jumped onto that as the preferred free Unix due to it being unencumbered by the massive legal warfare taking place in BSD Land (of course, SCO would eventually bring the battle to the GNU/Linux world, but by that point, Linux was already well-entrenched).

lkjsadflkljdsaf• 11 years ago

Support OpenBSD, but NEVER fork it..

http://www.openbsdfoundation.org/

http://www.openbsd.org/want.html

http://www.openbsd.org/donations.html

https://www.openbsdstore.com

hackuser• 11 years ago

"It is recommended that users install ..." OpenBSD?

The EU isn't serious if that's what they mean. It's not really an option for end users. My impression is that even technical users who are new to *nix should start with something more accessible.

Does the OpenBSD community even want to deal with a flood of nubes?

EU study recommends OpenBSD

Related Stories