▲ 129 points
back
61 comments
Earlier submission:
Release image [1] is inspired by works of Louis Wain[2]. Name of the release image references one of his works[3].
[1] https://www.openbsd.org/images/ImHappyBecauseEveryoneLovesMe...
[2] https://en.wikipedia.org/wiki/Louis_Wain
[3] https://arthive.com/artists/11470~Louis_Wain/works/466546~Im...
I appreciate you pointing this out. While it's okay to "steal" art style towards developing one's own, it also feels great to attribute credit to the source of inspiration. None of us are anything without those who came before.
I don't think that they "stole" it. Just a nice tribute to the artist that also fits the theme. I am a fan of Louis Wain's work and just felt like sharing.
Why is this marked [dupe]? This link is the official release page, and the most active discussion for it on HN today.
Announcement mail: https://marc.info/?l=openbsd-announce&m=169746103423179&w=2
From a networking perspective, I'm looking most forward to route-based IPSec tunnels: https://man.openbsd.org/sec.4
On the Linux side these are called "vti" devices, and they're simpler to use than most other methods, and also the default when interacting with cloud service providers IPSec gateways.
What’s up with this seeming resurgence in interest in IPSec? Did Jason politically/socially mess up? Or are people realizing IPSec solves some novel problem outside the scope of WG?
I think it's great there is new attention to OpenBSD's IPSec stack. IPSec is still widely used and is the defacto VPN tech for many large corporations, even if wg is simpler and easier to deploy. IPSec tends to be built-in to enterprise routers, but I'm not sure if wg is.
> What’s up with this seeming resurgence in interest in IPSec?
IPsec is implemented on many/most network routers/firewalls, and so can be plugged into existing infrastructure perhaps.
I think VPNs for general use are just increasingly popular as many people have privacy concerns, many governments are interested in or actively regulating internet speech, getting around geoblocking and copyright restrictions, etc. (not to mention, very aggressive advertising by commercial VPN providers). Remote working has probably increased use as well.
IMHO they really need a two-step release process for changes to pf.conf syntax. In the first step you get a warning when running the service about a deprecated syntax, then drop it. Over the last 20 years I’ve been bitten multiple times by changes to pf.conf which not only breaks your firewall, but invalidates entire published books on pf, countless articles, tutorials, etc.
I read some quote from the BDFL once where he said something about breaking changes being good because you’re “in a better place” but I feel the BC breaks are too aggressive to rely on pf directly in anything but small commercial applications. If you want to to tinker and break your home network fine.
This is why the upgrade guide says to actually read the changelog; they tell you the changes. I've only been bitten once, and it was because I didn't read first.
>> Read through and understand this process before attempting it. For critical or physically remote machines, test it on an identical, local system first.
>> Read configuration and syntax changes and the package upgrade instructions. There were several configuration changes and changes in packages that may require planning before starting the upgrade.
Typically you don't have breaking changes for a point release.
For OpenBSD at least, every release has equal weight and always increments by 0.1. There isn't a distinction between major and minor releases like other projects have. There are patches/errata, but those don't bump the version.
Theres a reason they call it an system upgrade, and not a patch or update. Blindly upgrading anything important without rtfm is just plain irresponsible, yet OP has used openbsd for 20 years and keeps making the same mistake over and over; typically you don't do that.
The best way I've seen is to have the upgrade itself migrate the config, when at all possible.
Sometimes it can't be done, because the changes are entirely orthogonal, but trying your best is quite helpful.
Or you just do like Linux apparently seems to do and introduce a new software firewall every few years :D
Aww, I was most excited about the release song! Is it not happening anymore?
OpenBSD 7.2 did not have a release song, but OpenBSD 7.3 did.
https://www.openbsd.org/72.html
https://www.openbsd.org/73.html
Likewise there has been several other versions that did not have songs either in the past.
https://www.openbsd.org/lyrics.html
So probably there will be more songs in the future too, even if not every release has a song.
I still miss buying CD sets. I understand why the project doesn't do it anymore (lots of effort and time, similar to why VAX was dropped), but it sure was fun getting them in the mail and using official discs to install.
Also looking forward to artwork merch but that's still for 7.3 on their shop, maybe it will be updated in a few days?
Why was this marked a dupe? Both were posted about the same time, but this one actually has upvotes and discussion...
What people use for hardware now that pcengines' apus are eol?
OpenBSD supports Ubiquiti's octeon processor. I thought it would be neat to run my router on a non-x86 CPU, but I don't have personal experience with these boxes yet.
I'm curious to hear others' answers to this question as well. I've been looking into building my own OpenBSD based home router and so far thinking a Protectli Vault [1] would fit the bill.
I was recently looking at some Banana Pi boards, but I'm not sure if any of them other than the R1 will run OpenBSD. HardKernel's ODROID-H3 is tempting, but the cases are not great looking.
I don't think OpenBSD supports it, but the Traverse Ten64 has ten gigabit Ethernet ports, eleven antenna mounts, and up to 32GB of ECC RAM:
I've been using a NUC! My only "complaint" is that the model I'm using only has 1 built in NIC, had to add another via USB. It works very well.
You could use VLANs and ditch the extra USB NIC if you want.
They state on their webpage that they have bought a lifetime supply of those chips. I wouldn't call them EOL
As I have none, it is for me.
EOL as in "no longer sold" or "cannot install new openbsd releases on them"?
They're no longer produced but still serve as a perfectly capable home router. Even my previous APU 1 is still a rock solid performer.
Protectil VP2420 here.
I love how OpenBSD continues to support and fix issues on a wide variety of hardware. I personally run it on various machines, from Pentium MMX (1997), AMD K6-3 (1999), to modern machines. 486 support was dropped just a couple releases ago, and was supported longer than VAX.
> Fix a bug in the handling of SCSI drives in the bootloader on the luna88k architecture.
> Correct undefined behavior when using MS-DOS filesystems, fixes imported from FreeBSD.
> On arm64, use the deep idle state available on Apple M1/M2 cores in the idle loop and for suspend, resulting in power savings.
> Update AMD CPU microcode if a newer patch is available.
OpenBSD has a reputation for being super secure but are there any big organizations that actually use it for security critical applications? A quick search shows outdated or non-related results.
I'm possibly motivated by different reasons than other users but I think an understated feature of OpenBSD is that it's simple
The unique security features are nice but really there's a lot to say about how simple an OpenBSD system is to use and configure.
Simplicity is security. There are less things that can go wrong.
I've seen it used before commercial security/networking appliances got "good" (generally pre-2010ish), but I think its use has diminished. I was a huge OpenBSD user back then as the networking (routing/firewalling/etc) was so simple AND powerful. I stopped when screenOS and later Juniper matured to the point where updates were just uploading firmware and hardware upgrades were just dumping the old configs in.
I knew it was deployed at a few non-tech oriented fortune 500 companies (eg not banks or tech firms) as last as 2016, but I've been out of that market since.
It's like a scene from some movie, there's a hacker in a dark room, connects to some machine deep inside of mega corp and the login prompt comes on screen...
Connected to 123.4.002.312
Welcome to OpenBSD 6.2!
login:
That reputation was and still is propagated by OpenBSD fanboys.
When put to scrutiny OpenBSD fails the same way any other operating system does(https://isopenbsdsecu.re/about/)
OpenBSD is secure in the default install; it's just that their default install has basically had everything turned off since forever.
Mind you, that was a great improvement over things like Windows NT, but "this is super secure as long as you don't do anything with it" is not as incredibly useful as it sounds like at first.
I have read that many security innovations [1] get implemented in OpenBSD soon, like W^X [2]. But I don't know enough about OpenBSD and I would like to hear as well if any organization uses it for mission critical applications.
More secure than what?
Given the world runs on Linux servers, its pretty obvious that is probably the most secure.
Outside black boxes like M$ and Apple, FOSS OS level seems quite secure. How often do you see Linux malware caused by OS in the wild? Sure you install wordpress and never update it and get a cryptominer installed, but its not like anyone is pinging a server with a picture and an overflow error is causing a Pegasus exploit.
Their reputation is very much exaggerated. It came from the early 2000s where they were 'secure by default' simply for not having services enabled.
They have done a lot of good, but they primarily equate security with code quality which is very short-sighted.
I liked this one
* Do not calculate IP, TCP, and UDP checksums on lo(4) interfaces.
This is the commit for those curious: https://github.com/openbsd/src/commit/c778c0d73570b51def4f06...
> Packets sent over loopback got their checksums calculated twice. In the output path they were filled in and during TCP/IP input all checksums were calculated again to be compared with the previous result.
Avoid this by claiming that lo(4) supports hardware checksum offloading. For each packet convert the flag that the checksum should be calculated to the flag that it has been checked successfully. Keep the flag that it should be calculated for the case that it may be bridged or forwarded later.
A drawback is that "tcpdump -ni lo0 -v" reports invalid checksum. But that is the same with physical interfaces and hardware offloading.
OK dlg@
so, a tcpdump/wireshark trace on lo will now show all packets as red/bad? That sounds annoying.
But I get why they did it, it probably makes sense in most real-life scenarios
Why use an old version of ffmpeg?
What is the use of ed25519 x509 TLS certs, which TLS clients support that and which CAs would sign that?