OpenBSD Journal

Looks like yet another patch to OpenSSH that the OpenBSD people will stay away from as far as the can. What can go wrong ? At least that is my belief, do people here think my speculation is correct ? I checked https://undeadly.org and no mention of anything like this. FWIW, I will never use this.

OpenBSD had Soft Updates, which isn't really journaling but sort of similar. It was suppose to help with with file system integrity, in the case of crashes. OpenBSD removed it last year because it got in the way of VFS updates, and was hard for the team to maintain[1]. I love OpenBSD, but it really does need a modern filesystem. The current team might be to small or just not have the right people to do a new filesystem. HammerFS2 could maybe be ported (and one has to wonder if that's not one of the thing that would requires VFS layer updates). Much of the current work on filesystems are being poured into GPL licensed code or ZFS, which also have an unfortunate license, so OpenBSD either has to borrow HammerFS, or do their own thing, which they probably don't have the resources for. 1) https://undeadly.org/cgi?action=article;sid=20230706044554

This is great! I’ve been using ipv6 on openbsd for a while now, starting with a hurricane electric tunnel years ago then to native v6 on Comcast and now Sonic. Configuring ipv6 PD has not been supported in base this whole time. I recall using wide-dhcp6c years ago and then switching to the dhcpcd in the article. The situation has improved, slowly, but it will be great to have this in the base system *EDIT*: dhcp6leased landed in base yesterday: https://www.undeadly.org/cgi?action=article;sid=20240604085042

Dear lord, it really is not that simple. Having ported software and served as a package maintainer on both the Linux and BSD side you get anything from pathetically easy to nearly impossible (Julia on NixOS was one hell of a journey). Just yesterday we had a great article posted about some of the effort that goes into getting a big piece of software like Firefox to run properly on OpenBSD [1]. [1]: https://undeadly.org/cgi?action=article;sid=20230912094727

Some OSs like OpenBSD have already implemented a 64-bit timestamp to account for this [0]. I am not sure about Linux. I would think that this is a problem that would greatly affect older systems (like all the banks' mainframes... yikes!) [0] https://undeadly.org/cgi?action=article;sid=20130813072244

Unfortunately, there were periods in the past where it did not sell well. "The bad news is that OpenBSD for the past 2 years has turned a loss of approximately $20K USD ($40K total). I don't think I need to explain in many words what that is doing to our beloved OS, and worse, our main systems architect. This is starting to seriously impede the development of OpenBSD and OpenSSH... "What I want to point out what a lot of people don't seem to realize is that OpenSSH development is paid from the same pool of money as OpenBSD. OpenSSH is in use by millions around the world however the revenue stream just simply isn't there." https://undeadly.org/cgi?action=article;sid=20060321034114

Additional great read: the author (long-time OpenBSD developer Ingo Schwarze) explaining his motivations and discusses other plain-text accounting systems, including Ledger: https://www.undeadly.org/cgi?action=article;sid=20200928123430 As a long-time Ledger user, I'm tempted to try PTA out. The journal's single-line syntax looks great, more robust to parse with Unix tools as compared to Ledger's multi-line journals. PTA's account numbering system is also similar to what is common in my country (Eastern Europe). Also, the whole thing appears to be a single Perl file, so it probably runs out of the box in every Unix system. Really neat.

To me, OpenBSD project is the "gold-standard" of security. If they [1] consider WireGuard to be a project worthy of importing, then I don't need any random article to convince me otherwise of its security properties. [1] https://undeadly.org/cgi?action=article;sid=20200622052207

OpenBSD usually doesn’t care about what others think is dead. See https://www.openbsd.org/opencvs/index.html and https://undeadly.org :)

As best I can tell, tmux is developed primarily by Nicholas Marriott for OpenBSD and made portable with libevent. The original paper uses OpenBSD, and here[1] he says: “I preferred to work on it in base: I felt tmux would be improved by being part of OpenBSD.” [1] https://www.undeadly.org/cgi?action=article&sid=20090712190402

Undeadly.org mentioned the following highlights: "Selected highlights include: * Support has been added for qcow2 images and external snapshots in vmm(4)/vmd(8). * "join" has been added for Wi-Fi networks. * Security enhancements include unveil(2), MAP_STACK, and RETGUARD. Meltdown/Spectre mitigations have been extended further, and SMT is disabled by default. * rad(8) has replaced rtadvd(8). * bgpd(8) has undergone numerous improvements, including the addition of support for BGP Origin Validation (RFC 6811). smtpd.conf(5) uses a new, more flexible grammar. * For the first time, there are more than 10,000 (binary) packages (for amd64 and i386)." [1] [1] https://www.undeadly.org/cgi?action=article;sid=20181018140057

Ironic for Theo to call someone else an asshole. Putting people on the defensive is a great way to not get what you want. https://undeadly.org/cgi?action=article&sid=20060930232710

> there literally isn’t any documentation of LibreSSL. This is plain wrong, it's particularly annoying as a great deal of effort has been put into updating the documentation [1]. > Instead, you just have to read the OpenSSL docs, and just hope the behavior is roughly the same. I'll give the author the benefit of the doubt and assume they refer the "OpenSSL docs" as naming hasn't been changed, as opposed to looking at actual OpenSSL documentation. Indeed it doesn't make a great sense rename everything in the documents because as the LibreSSL website states. libssl: a TLS library, backwards-compatible with OpenSSL libtls: a new TLS library, designed to make it easier to write foolproof applications [1] https://undeadly.org/cgi?action=article&sid=20161215221715

Luckily I moved everything to openbsd's libressl which is /mostly/ compatible. I wonder if this bug affects them, typically the HIGH's haven't[0] It really feels like every other week there is a bug in OpenSSL and after following along with the libressl blog I understand why- the code is an absolute mess[1] [0] http://undeadly.org/cgi?action=article&sid=20150319145126 [1] http://opensslrampage.org/page/49

http://undeadly.org/cgi?action=article&sid=20150304092744 The following CVEs did not apply to LibreSSL: ... CVE-2015-0204 - RSA silently downgrades to EXPORT_RSA Don't forget: http://www.openbsdfoundation.org/

I originally read this article following a link from undeadly.org, the "OpenBSD journal", which provided enough context for me: http://undeadly.org/cgi?action=article&sid=20150209112628

The closest that I know of is http://www.undeadly.org which does a good job of covering news, sprints etc

> Under a regular user account? Yep. Only special factors I can think of are VirtualBox guest additions and passphraseless sudo - though I don't recall any similar problems when I last had it on my laptop which had neither. Also starting from console and not a display manager, because they're vile things that are almost as bad as splash/boot screens. > I know their team is much smaller so it's just not feasible, but it's definitely something that would be greatly appreciated. Very much so - the biggest thing I miss from the Debian world is unattended-upgrades. Maybe with some more commercial support.. > Is OpenBSD's MP-safe yet? I believe that's partly related to why FreeBSD's has ALTQ disabled It's still under a big giant lock as far as I'm aware. They're also removing ALTQ in favour of a simpler framework: http://undeadly.org/cgi?action=article&sid=20140419151959

The list misses one of the best. Connect through a jump host directly to the target server using ProxyCommand and nc: http://undeadly.org/cgi?action=article&sid=20070925181947 Combines well with aliases - prefix all hosts with a common name and use "Host prefix-*" to setup the ProxyCommand.

I'd say you're right, but it seems bkor (and I feel somewhat the same) read some judgement in your summary. My summary would be So basically "We're really focusing on Linux officially now, since that's what we're accustomed with. But look at these great ports to two different BSDs!" Paired with the blog post at [1] (linked elsewhere in this thread) the situation doesn't look as ugly as people are trying to imply. 1: http://undeadly.org/cgi?action=article&sid=20140219085851

Actually I am considering C. It's pretty easy to write a CGI that Apache can call. Process startup is pretty cheap on UNIX and it's secure if you suexec, chroot it and know how to write C code that isn't full of holes. http://undeadly.org/ is written in C. Source: http://undeadly.org/undeadly-src.tar.gz

For what it's worth, the OpenBSD team is working on improved buffering for high-RAM machines: "Computers today have immense quantity of unused memory. This new software almost works, we still have some minor bugs to fix, but the results so far are incredible. On computers with 16GB of RAM we can dedicate as much as 13 GB to buffering and almost no data is read from the hard drive, everything is in the RAM. It performs even faster than SSDs. We only have to write to the disk anymore and that’s mainly for reliability reasons. I estimate we’re a year away from the whole thing working flawlessly. From this aspect the 6 month release cycle is a bit limiting." http://undeadly.org/cgi?action=article&sid=20111018061633

People love to talk all sorts of trash on this kind of stack but it's really quite solid for what it does. If anyone was ever curious what a sizeable codebase in this kind of code would even look like, check out the source code for undeadly.org [1]. Yeah these people may be crazy but they're also OpenBSD developers and we really love to see what we can get away with using nothing other than what's available in the base distribution. I think a lot of what you see being written for production ends up being very similar to this kind of approach, maybe just utilizing rust or golang as the web application backend language if that's what is the more comfortable thing. Nothing but the base system and a single binary, not relying on an entire interpreter stack, sure can be smooth. There's other examples of this kind of approach, too, writing straight C Common Gateway Interface web applications in public-facing production use - What comes to mind is the version control system web frontend that the people who write wireguard use, cgit [2] - If it's really so crazy then how come the openbsd and wireguard people - presumably better hackers than you - are just out there doing it? Other places you see C web application interfaces include in embedded devices (SCADA, etc) and even the web interfaces for routers, which unfortunately ARE crazy because check out all the security problems! Good thing people at our favorite good old research operating system have done the whole pledge(2)[3]…

Good software isn't like a real-world monument; people don't spend effort to go back and revisit it later and gawk at it. Good software either gets championed by someone, or it fades forever into obscurity. (I wrote a really amazing hack years ago ... in COBOL. Maybe you've heard of me?) Likewise, the people that are contributing to BSD right now are doing so because they believe in what they are working on. Although some of them are true cross-platform developers, many others would never make the switch. It would be agony trying to work in Linux if you're, say, Theo de Raadt. Seriously, I wonder if that might be his own personal version of hell. I use a lot of both -- Debian, an Arch-like thing, OpenBSD, FreeBSD, and have for years. The only reason that I know that iptables has serious shortcomings is because I've used pf. If I had never used the BSDs, I would have no idea what I was missing out on. If I had twenty more hours in a day, I might even be tempted to make iptables more pf-like. pf is kind of my go-to for BSD cheerleading, but it shines in other core areas too. For instance, Linux is really only just now getting stuff that looks like a distributed or cluster file system; but BSD has had this for quite a while already. Heck, one of the best options for a while in this area was HAMMER, developed by one guy for his personal BSD. And if you wanted something a little bit more mainstream, FreeBSD has supported ZFS for a long time -- Linux is still catching up there.…

What the Internet is really doing away with is a giant industry that used to be useful, but now is merely parasitic. That can go both ways: the Internet is also breeding a generation of customers that used to value and support music & books, but now is merely parasitic. we can just give $1.50 to the author directly I'm all for eliminating middle-men, but free is still a whole lot better than $1.50; and when downloading hundreds of songs from PirateBay, that's several hundreds of dollars versus free. Musicians who embrace the new reality are doing fine. Citation needed. I would also love a functional gift economy, instead of one of scarcity ... but on the Internet a gift economy doesn't really work, because most users are not giving back. How many users of open-source software are giving back contributions and donations? Even when your software is used by lots of corporations; you either have to beg, or your software has to be broken (in need of a fix). And I quote from http://www.undeadly.org/cgi?action=article&sid=20060321034114 ... OpenSSH is in use by millions around the world however the revenue stream just simply isn't there. Music, books, software: all of them require effort and lots of it. Being able to work on such things full-time is wonderful; and if broken technologies/legislation like DRM are the only solution for it, then that will be the future.

I disagree. ;) In my dozen or so years of experience with Theo, we've disagreed and argued many times and he's always been reasonable. For the record, if I had bothered to keep track of our debates, he's ended up being "right" far more often than I have. Yep, I've been wrong, quite often, and he's been kind enough to drop-kick me in a better direction. He's a friend and I've learned a lot from him over the years. Your misconception comes from people showing up on the OpenBSD mailing lists with a prideful hostile attitude intending to prove how much they know, when in fact, they haven't done their homework correctly or completely. Things often go sideways in a hurry if people aren't willing to look at their own opinions critically and do the additional work to see the other sides. Of course, if you walk into someone else's home and shit on their couch, you get what you deserve. There are edgy debates between developers, particularly in code reviews and proposed patches, but the reason for them is simple; everyone wants to get to the "best" and "most correct" answer. In other words the goal is the same, but the opinions vary. Being friends with the person/people on the other side of a pointed debate is important, particularly across (human) language barriers. Jake Meuser recently wrote about this on undeadly.org and I can't express it any better than he has: http://www.undeadly.org/cgi?action=article&sid=20101206081625 It's a worthy read.

Related to OpenBSD/hppa platform support, see perhaps the recent post "The scariest boot loader code": * http://miod.online.fr/software/openbsd/stories/boot_hppa.html * Via: http://undeadly.org/cgi?action=article;sid=20251231080327

Openbsd's ffs Log message: Make softdep mounts a no-op Softdep is a significant impediment to progressing in the vfs layer so we plan to get it out of the way. It is too clever for us to continue maintaining as it is." https://undeadly.org/cgi?action=article;sid=20230706044554

As noted, recent changes to OpenBSD TCP handling[1] may improve performance. On a 4 core machine I see between 12% to 22% improvement with 10 parallel TCP streams. When testing only with a single TCP stream, throughput increases between 38% to 100%. I'm not sure that directly translates to better pf performance, and four cores is hardly remarkable these days but might be typical on a small low-power router? Would be interesting if someone had a recent benchmark comparison of OpenBSD 7.8 PF vs. FreeBSD's latest. [1] https://undeadly.org/cgi?action=article;sid=20250508122430

Theo was recently proposing a new flag to open, O_BELOW: https://undeadly.org/cgi?action=article;sid=20250529080623 It's like Linux's RESOLVE_BENEATH flag to openat, except it's a constraint placed on the directory descriptor itself so that subsequent opens using openat(2) cannot reach anything outside the subtree. Which seems like exactly the semantics you'd want for a capability system. In FreeBSD Capsicum mode, this behavior is enforced implicitly[1], but it'd be a nice thing to have explicitly to help incrementally improve code safety. [1] See https://man.freebsd.org/cgi/man.cgi?open(2)#:~:text=capsicum(4)%20capa…