Been running 6.5 snapshots in my travel laptop for some weeks and everything just works. The laptop is a ThinkPad X200 which is a bit slow for my needs, but upgrading it to ThinkPad X230 later this week should help.
I really enjoy how simple the system is after all these years with Linux. I will always continue using Linux in my main computers, but for surfing, some hobby programming and as a travel OS OpenBSD definitely won me over.
And I guess it runs quite nicely in the X250 and T450 tier already, maybe even newer ThinkPads. And when I say runs, I mean runs much nicer than many Linux distributions with their default installation.
>I really enjoy how simple the system is after all these years with Linux.
I still shake my head when I think back to the 90s and how Linux managed to overtake the BSDs. Good to see they are still very much alive and moving forward.
During the BSD lawsuit, free software was not widely understood, the company doing the suing (AT&T) was one of the biggest in the world, and the one being sued (BSDI) was a nobody by comparison. It was clear that AT&T had grounds for a real case. Everyone I know that was there says that there was real fear of the outcome. And I've known a lot who were there.
By contrast when the SCO lawsuit happened, open source was far better understood, it was a small company (SCO) doing the suing, and the companies being sued were the biggest in the world (starting with IBM). This threat was far less credible, and if it failed, everyone assumed that they would get lost in the shuffle.
It didn't hurt for the latter case that groklaw stepped up and there were endless well-informed people who said that the case was groundless. And no, I don't just mean nerds who read slashdot. But also most of the tech media, various interested lawyers, and so on.
The weird thing, though, is that 90s Linux felt a little more like the BSDs than Linux usually does today. I mean, the BSDs were always a bit more coherent, but the default install of a typical Linux distro felt a lot less "heavy" in the past. You can switch from Linux to one of the *BSDs and feel like you are bringing back the glory days.
Maybe this is a complaint about Ubuntu, or gnome, or systemd.
I tend to agree. I started with Slackware when I first used Linux and it is heavily inspired by BSD. It remains so today so I've switched back to using it for day to day work and on a few servers I manage.
All other servers are using OpenBSD so it looks like I've got some upgrades to get to!
I would disagree. In my experience OpenBSD is pretty good on a desktop or laptop. I've had fewer driver issues with it than FreeBSD for example (mostly wifi and graphics).
But "optimized for desktop usage" is a very vague term with different meanings for everybody. My tastes are geared towards a light X workstation that doesn't add any extra whistles unless you ask for them. In the Linux world the closest I've seen to this is Arch. I also used debian for a long time (starting with netinst and no GUI, and adding things only as I need them).
Sorry I was vague. I don't know the reasons for the difference, but on my X230 OpenBSD seemed to have higher latencies in starting programs, and ran big programs like chromium slower than ubuntu and void did.
Driver support is great, I agree. And the network management is far simpler. It just felt slow.
>Maybe this is a complaint about Ubuntu, or gnome, or systemd.
In the 90's Linux was pretty well aimed at the techy crowd. you were expected to know or learn administration (including the location of and editing of etc files) and not be afraid of './configure && make && make install'
Then the focus changed and while your Gentoos and Arches never went away, a larger portion of the focus was on either being user friendly and/or providing an enterprise desktop experience.
This is something the BSDs (with the exception of TrueOS) never did -and certainly not OpenBSD.
It's worth pointing out (and folks in this thread already have) that if you want the hacker's experience, it's still out there. It just has almost nothing to do with mainstream Linux (which is a shame).
Travel OS, so I basically browse the Internet, watch some videos, listen to some music and do some hobby projects. Also it's nice to have a not so expensive laptop for travels, so it's not such a big deal if it gets stolen. And of course the travel machine uses full disk encryption. Size is important here: I prefer 12" for travels and 14" for work, when I want to view multiple files at the same time.
OpenBSD has hard time using even 4 gigabytes of RAM with Firefox having multiple tabs open. My Arch installations easily take over 8 gigabytes, if I'm not compiling anything.
If I need a backup machine for work, I kind of want a Linux with all the Docker, Spotify, Signal etc. easily available.
I love the simplicity of OpenBSD as well, but not all Linuxes are bloated, Alpine for instance is quite reasonable. The main benefits of Linux are ZFS and Docker, as well as wider hardware support.
You have listed ZFS as a benefit of Linux in contrast to BSD, but BSD has better support of ZFS than Linux, so I'm curious why you listed ZFS in this way?
Odd that you put this on a the travel laptop and not the desktop, I imagine most OS polygot its the inverse for things like battery life, touchpad drivers, webcam driver. Am curious why not make the switch on desktop? Same semantics? Same dotfiles?
Do you use the same window manager across both linux and openbsd?
Also what's the "much nicer" you refer to.. Please sell me
I am a huge OS polyglot, I run Windows at work (heavily), Debian, Fedora+CentOS, FreeBSD (also at work on servers and for a long time on my work desktop) and was using openbsd as my only homeOS for 2 years. Now I'm on Arch and MacOS.. So I can weigh in.
>I imagine [..] its the inverse for things like battery life, touchpad drivers, webcam driver.
Battery life is as good as linux, much better than FreeBSD. FreeBSD was idling hard on my laptop (load average of 1.00, 2hrs of battery when OpenBSD was giving me 4. Windows gave me 2.5) Touchpad is "fine" but I was using an X201s mainly which has a teeny tiny touchpad. Webcam... I don't use webcams.. you'd understand if you saw me :p
> Am curious why not make the switch on desktop? Same semantics? Same dotfiles?
I can't answer the OP, but openbsd is actually super slick on laptops, it's good on a desktop too, but compared to FreeBSD (and wpasupplicant to connect to shit ++ bad battery life, and a bad security record) or Linux (where connecting to wifi basically requires use of a GUI) I think it's an acceptable choice. As for dotfiles, you'd be surprised how little changes to third party software there are.. I was running the same dots on my archlinux machine as I was on my FreeBSD and OpenBSD machines (with relatively minor tweaking of which programs control the up/down volume keys for i3)
> Do you use the same window manager across both linux and openbsd?
Yeah, i3.
> Also what's the "much nicer" you refer to.. Please sell me
No pulseaudio (the mixer in openbsd is kinda good, not as many features but that's not needed imo), no wpasupplicant - WPA is built in to ifconfig, really, astonishingly clear man pages. (for the first time in my life I was reading about how the OS was even built through man pages).
Oh and I don't want to start a fight, but I didn't miss systemd (even though I generally think the concept fits a desktop use-case quite well).
I mean, you have to try openbsd to understand really. Although, personally, the input latency and sluggish feeling really got me down, especially when web browsing.
Battery life is about double Windows and equivalent to Linux on my X220. Touchpad works out of the box on all my laptops including gestures, but I use the TrackPoint. Even without a big bloated DE installed, brightness and volume hotkeys Just Work[tm].
OpenBSD's a notable exception for ThinkPads specifically, primarily because most (if not all) of the OpenBSD devs do their development from within OpenBSD itself (i.e. using OpenBSD either as their primary system or otherwise with significant regularity), and said devs tend to reach for ThinkPads. So, naturally, ThinkPads ended up being the de facto "preferred" devices for (i386/amd64) OpenBSD.
Mac OS X only works for this due to herculean community efforts. The base system is fundamentally unusable for this purpose without Homebrew, Macports (oh hey, BSD ports!), or pkgsrc (oh hey, BSD ports again!).
The base packages get upgraded on a timescale approaching lolnever. They should be ashamed of themselves for shipping machines with Bash 3 still and that's just the tip of the iceberg.
OpenBSD is so simple for me and it takes me a fraction of the time to configure a new OpenBSD system than a new Mac.
> Mac OS X only works for this due to herculean community efforts.
For programming, yes, although I don't know if brew would be called "herculean". For battery life and ease of use, no.
I've setup BSD on linux on personally modded thinkpads (putting in faster cpus, new wifi cards, etc), and you have got to be joking when you say it's simpler or faster than turning on a new mac and installing brew. It's infinitely more customizable for sure, but it's not simpler or easier. Especially when it comes to tuning battery life.
And for highly used programs like adobe photoshop, illustrator/affinity design, premiere, etc, forget it. Even Sketch isn't available on linux.
And this doesn't account for physical clunkiness either. My t430 was so bulky. The x220 was nice but the display wasn't that good, nor the cpu.
Yes No multimedia programs, cause I am a mathematician and for pdf I use pdftools; so no Adobe also; started with Slackware in 2007 after an abysmal windows period from 1991 till 2007; now I use openbsd and emacs simply rocks and is rock solid on openbsd.
I think the parent poster has unreasonable expectations for what linux/bsds can do as far as laptop battery life and is talking about an entirely different use case than the parent I was originally responding to.
I also think they're vastly underestimating the amount of stuff that needs to be configured on a new mac host.
My office workstation (Arch Linux) and home desktops/servers (all OpenBSD) can be installed and configured repeatably in ~5 minutes flat.
I literally have an ansible playbook that pulls in my dotfiles and installs a list of the packages that I want. That's a hundred times simpler than setting up my work laptop (Mac) for development, where not only do I have to install xcode dev tools and homebrew and the packages that I want, but most of the packages that I install need additional configuration applied to work correctly.
I have openbsd on an old thinkpad been sitting and gathering dust. Rstudio isn't on OpenBSD and it'll take a bit of the down time to emulate it with tmux and vim... so I never got around doing it... too busy trying to finish my thesis.
How is your R setup in OpenBSD? Like what software do you use in tandem when coding R?
> I've setup BSD on linux on personally modded thinkpads (putting in faster cpus, new wifi cards, etc), and you have got to be joking when you say it's simpler or faster than turning on a new mac and installing brew. It's infinitely more customizable for sure, but it's not simpler or easier. Especially when it comes to tuning battery life.
This is not an apples-to-apples comparison. You're comparing highly modified laptops with questionably supported mods to a stock Mac. Of course the highly modified laptop isn't going to install BSD smoothly. It's unlikely to install anything smoothly, at least compared to a Mac where the hardware configuration is locked down.
I use MacOS at work, and I just can't get used to it. I love how fast I can navigate in i3 and how fast everything feels. I do like MacOS but I hate how the only shortcut keys to switch Windows are from cmd 1 - 5, I hate that I can't easily move windows without something like spectacle (that feels clunky - 4 buttons to move a window to another screen?) and I really can never get used to the cmd key placement :D
I've tried using Amethyst or whatever the tiling window manager is, but I found it crashed a lot and the keybindings weren't great.
Overall I think MacOS is a great OS, I just feel like I need a real tiling manager that I can't get without Linux.
I like simplicity. I use i3, Firefox with enough privacy extensions, Emacs and terminal. And I love to be able to have a great keyboard, where sadly the ThinkPads are the only choice nowadays.
Using Mac OS X or Windows will give me a headache. I just don't like their user interface. And I've used both of them a lot; I had my G4 iMac with 10.0.0 back in the days, and kind of liked 10.3.0 until Linux won me over again.
I'm just amazed that you are calling an interface you need to set up yourself / configure / tweak a bunch of things to get working is "simple" in your eyes compared to Mac OS X, which is simple to lots of people (which would explain why they sell so many MacBooks, in my eyes?)
I'm just a different crowd! I live in UNIX and for me editing a few text files is much simpler than having a bloated OS.
And why I said the thing about Apple originally is that it seems to be almost a meme that every single thread about Linux or *BSD gets a discussion about Apple products. It's so weird :)
Of all of the places a Bee and Puppycat fan might expect to find Natasha Allegri's work ... release art (?!) for OpenBSD 6.5 is perhaps the last I would have expected.
The story is written so well, I'm not sure it's not a bit embellished. :)
Anyway, there's all kinds of people, everywhere, and I don't think those two characters are representative of Texas as a whole. Texas has a lot of diversity, a lot of good work comes out of there, and people are generally decent and not like the extremes that sometimes percolate to the TV news.
Also, to the extent that Texans overall might tend to have qualities like, e.g., valuing principles and individual responsibility, I think that's good input to have, in a diverse marketplace of ideas (even though it might not be quite my own current thinking).
(Please pardon the straight response, on a humor tangent, but I felt a little bad when I realized I'd invoked a stereotype, and I felt I should clarify.)
Oh my, what is the story behind the piece of artwork in this release?
The buzz around OpenBSD always led me to believe it's developed by mole people who subsist on cryptographically secure random donations of soda crackers and water.
Yet here on their release page is a big beautiful image that precedes technical release desiderata.
Can more projects do more beautiful artwork like this?
Also, can I support OpenBSD by buying a tshirt with this artwork on it?
Edit: Just noticed that the stem of the "p" in "OpenBSD" is not obscured by the underline (at least in Chrome). That, along with the italic "Open" with non-italic "BSD" is quite aesthetically pleasing. Is this due to a design whiz who got interested in BSD, or is this just HTML5 doing its thing?
> Edit: Just noticed that the stem of the "p" in "OpenBSD" is not obscured by the underline (at least in Chrome). That, along with the italic "Open" with non-italic "BSD" is quite aesthetically pleasing. Is this due to a design whiz who got interested in BSD, or is this just HTML5 doing its thing?
This is just Chrome's default rendering of underlines, which occurs even with no explicit styling:
data:text/html,<u>upu
In my opinion, it's a cute stylistic effect which looks nice in headers &c., but feels inappropriate in running text. An odd default.
> First release of unwind(8), a validating, recursive nameserver for 127.0.0.1. It is particularly suitable for laptops moving between networks.
When systemd-resolvd was first released it was the biggest mistake ever to write a new recursive resolver instead of using unbound or dnsmasq. Also since DNS ".. wasn't broken, so it did not need fixing".
I wonder if unwind will be received with the same hostility.
OpenBSD has done a few of these daemons over the years, where they reject existing popular implementations to do their own with their own priorties. I started typing a list but really there are too many, big and small. They tend to have the OpenBSD minimalist, security focused, "no bullshit" approach.
In a way, OpenBSD isn't really written in C. It's written in a special subset of C that uses some different, more secure core functions and any where any trade-off for performance instead of security is ruthlessly weeded out when reviewed by the people involved.
I'm of the opinion that using C and C++ for future major work where there's not good reasons forcing you to is more trouble than it's worth, but I wouldn't mind if it was all done with the care and attention the OpenBSD developers put into their projects.
While I'm generally sold on the OpenBSD strategy of replacing mainstream daemons with stripped down secure versions, I don't think it is at all reasonable to suggest that OpenBSD's library idioms mean it's implemented in something other than C (nor would it be reasonable to say that about Dan Bernstein's software, which goes even further in this direction). It's still C, and it still has memory corruption vulnerabilities.
Sure. I just meant that since they adopt and enforce the usage of secure equivalents to some common functions (e.g. some string utilities), and along with very strictly enforced rules about how code gets accepted, it's about the best we can expect in some situations. Not everyone is willing to consider using something other than C. I think the pragmatic approach is to point to C projects that have been largely successful in their security approach. If it causes them to adopt the onerous requirements for safe C, or to reevaluate their position, I count those both as positive outcomes.
As far as I have seen, every time a project uses C, they end up transforming it in some subset and if you want to contribute, you must learn that C subset. It’s almost like DSLs.
I think that’s expected, and cool, given that C is a general purpose language and very flexible.
It's C with better libraries and coding standards for security. A different dialect might be something like Cyclone, Cilk, MetaC, Frama-C, or ZL that change the language to help them achieve their goals.
unwind uses libunbound, so it's a little different then some of their other greenfield projects. (See my post elsethread.) Like with OpenSSL/libressl they're not reinventing the wheel so much as just inventing a new kind of vehicle to place atop the wheels.
And also in general, I'm far less concerned about software released by a well-established security-minded team than I am about whatever Lennart wants to ship...
The difference is mostly in the track record of the people behind the effort.
DNS software in general has left behind a trail of security vulnerabilities. The systemd team has also left behind a trail of security vulnerabilities. I don't want a team who isn't focused on security to replace something security critical when the existing software seemed fine enough.
On the other hand, the OpenBSD team consistently delivers on small, focused utilities, built with security in mind that usually reduce the scope of the utility to the minimum required.
OpenBSD also still includes Unbound (/usr/sbin/unbound) as the standard local recursive resolver, and NSD (/usr/sbin/nsd) as the standard authoritative server.
People are probably less upset because it doesn't take the "systemd all the things" approach of getting rid of huge chunks of old stuff for what is ostensibly an init system. I don't have much of an issue with systemd (except binary logging; I hate that) and just put up with it, but the reasons for which people objected to systemd don't seem to extend to this.
The only connection that systemd-resolved has to the init system is the name prefix. Seems odd to praise the BSDs for developing everything in a single repo but faulting systemd for the same approach.
> Seems odd to praise the BSDs for developing everything in a single repo but faulting systemd for the same approach.
I think it is more accurate to say that the (supposed) problem with systemd's approach is actually tight coupling as opposed to a single repo.
OpenSSH, OpenSMTP, OpenBGPD, LibreSSL, Mandoc, the recent Unwind, etc, may all be in the same repo, but none depending on each other. Try taking systemd-resolved (or journald) and running it on its own.
If the various systemd "components" were actual components that could be swapped out for something else there would be fewer complains IMHO.
systemd-as-init-replacement is/was fine. systemd-as-kitchen-sink is where things went sideways.
And replace it with what? I genuinely don't know anything that exists right now that could replace it. Linux and ecosystem have a lot of IPC primitives but very few usable systems: I know of dbus and ip.
I didn't praise them for that. It's more that I don't like the systemd way of making everything systemd. The difference is that the stuff openbsd develops is largely standalone applications, whereas systemd wants to take over the world and replace everything.
This makes it very hard to tweak a system, and I would again bring up the logging issue. Systemd-journald stores files in binary format, which is a pain. I was working on something where I accidentally bricked the system (VM, thankfully) due to configuring some in-depth security stuff. I mounted the disk and tried to read off the log, but couldn't. It's also a pain to replace it, and non-systemd alternatives are becoming increasingly poorly supported.
Systemd wants to take over temporary files, journaling, and much, much more. Many of the implementations are imperfect. That's fine; I understand it's hard to get that much right. Which is why I wish they made it easier to replace systemd components or didn't use it.
The init itself (units etc.) is good, and I actually like it. I just wish they got that polished, then made another, separate project if they thought they could do another piece better.
The assumption here is that the machine you're using to do the log analysis is also a Linux machine that uses systemd (and thus has a journalctl binary). This is not necessarily true.
A lot of the annoyance that some people have with the systemd crowd is that these kind of assumptions are made all over the place. The actual software is not bad (I really do prefer dealing with systemd units than writing shell scripts for each service) but it can be hard to get past.
Exactly. I was doing a competition that required me to run windows with a linux vm on top of it. This means I couldn't easily do it. Ended up having to use WSL, which is much more hassle than I ought to have to go through.
I agree as well with the unit comment; they're great. But I just can't get past the plans for world domination.
I'm not sure I see the problem. At scale, you're logging into an aggregator anyway. If part of your job is log recovery/analysis then you need to get the right tools working (docker works almost everywhere now, so that should solve it). In a small environment, I'm you can find a way to run a VM somewhere temporarily.
I was doing security on a VM image. I wasn't doing anything at scale, and wasn't doing the initial deployment. Log recovery/analysis wasn't the job, it was a necessary component thereof. Docker makes no sense when I'm doing OS-level hardening on a VM.
As far as I know, it is an explicitly stated goal of the systemd project to provide an integrated (compared to whatever each distribution assembled together to provide one) base system on top of the Linux kernel with the intent of making the best use of the features provided by the kernel.
It seems to me that Lennart looked at the tightly integrated base system + kernel approach of the BSDs and decided he wanted that for Linux too (in addition to whatever other influences he had), and then he made it happen.
Fwiw, apart from journald and logind that’s true for systemd as well. You can choose to run nothing other than pid 1 and these two daemons. Everything else is optional.
This terminology is tricky, and the fact that toast0 incorrectly thinks that this is a "stub resolver" is indicative of how people get this stuff wildly wrong. A "stub resolver" is in fact the client that makes requests of the server that you are asking about.
I use terminology borrowed from HTTP when explaining this to people. A DNS server that listens on a local IP address and makes back-end queries to another DNS server is a proxy DNS server, and the fact that it hands off all of the grunt work (of stitching together the back-end partial answers to make the front-end complete answers) to another proxy DNS server makes it a forwarding proxy DNS server. If it didn't hand off the grunt work and did all of the query resolution itself, talking directly to content DNS servers, it would be a resolving proxy DNS server.
And the software that is in applications, that formulates requests and sends them over to a proxy DNS server, is a DNS client library.
Stub resolver: A resolver that cannot perform all resolution itself.
Stub resolvers generally depend on a recursive resolver to
undertake the actual resolution function. Stub resolvers are
discussed but never fully defined in Section 5.3.1 of [RFC1034].
They are fully defined in Section 6.1.3.1 of [RFC1123].
I thought it means exactly that for X you need to run xenodm.
But if you don't want to run it by default you can use "doas rcctl start -f xenodm" to start display manager when needed.
I was incorrect: It appears that you do in fact need root to run startx now:
(quoting the faq page for upgrade65):
Xorg(1). The Xorg binary is no longer installed setuid, so startx(1) can no longer be used by non-root users. The xenodm(1) display manager has to be used instead.
I have done this before. Marked a release in the changelog set to two weeks in the future, then installed from master and made sure nothing broke during those two weeks.
> [...] This artwork emblazoned CDs and posters up until version 6.0, after which we stopped producing product and only release software on the internet.
See also [0]; you should be able to make your own t-shirt with official logos, and donate as usual [1,2,3]
What with the artwork thumbnails for the first row of the "CD-Rom era" (6.0 - 5.2) not matching the artwork shown at the top of the linked page when you click it? Some of those look really interesting, but you get something entirely different when you try to find a larger version.
Just to say I also love this OS, although I'm very far from a hardcore hacker.
It just worked out of the box on that generic unbranded laptop I retrieved (no touchpad though).
I use Xfce wich is well integrated, and the package manager is plain simple and easy.
Definately better experience than my previous Linux ones.
Some penalty on performance though.
This is some serious OpenBSD artwork.
I would love that they reconsider the 'no product' policy. I understand the logistical nightmare of pressed CDs though...
Well, at this point it'd be pressed dual layer blu rays though, i downloaded the entire version and just the amd64 directories are around 45GB in size. I do not understand why they feel the need to associate OS versions with 3rd party packages though, why have an OpenBSD 6.5 version of -say- the 0ad game instead of an OpenBSD version of it that you say it needs at least OpenBSD 6.5 (or whatever) version to run?
(same question about Linux distros in general, FWIW... i just do not see the point of packaging so much stuff for a single OS version, it is like if Windows did the same thing - ignoring licensing - Windows 10 would include Photoshop, Steam, DOOM, Visual Studio, Maya, 3ds max and pretty much every other program with a bit of popularity ever made)
Well, at least a single arch version still fits on a single disk medium, last time i checked Debian needed several DL BDs (although perhaps a single BDXL disk, once they become available, will work... assuming we also ever burners for those).
OpenBSD is particularly aggressive about breaking backward-compatibility, yes. For example: the switch to a 64-bit time_t on 32-bit systems to stay ahead of the Year 2038 problem.
As a long time Linux user, I keep thinking about trying a BSD variant, but I get hung up on two things.
1) Which do I pick? NetBSD? OpenBSD?
2) Hardware? I'm thinking about an old ThinkPad for programming, and it looks like OpenBSD at least should run fine on that. What's hardware support like overall?
An Thinkpad up to the 4-Series (x240,t440,t540) can run any BSD, but after that, OpenBSD is your best bet. NetBSD (the one I learned about Unix with) has fallen a bit behind in features and hardware support, it is rarely used for production any more (makes me sad, but that is how it is). FreeBSD has a giant set of features and has the most current and largest software library, yet it does not run perfect on newer Laptops. OpenBSD ist more conservative and very pure, is used in some production environments, is actively developed but has the smallest and least up-to-date software library. So you can choose which disadvantage you can live most with. NetBSD is said to run on the largest number of platforms, but I'd argue that in practice Linux took its place long ago.
I think there's a bit of a difference in that NetBSD project itself (kernel and userland) run on all the platforms/architectures, and Linux (the kernel) supports a lot of platforms/architectures itself, you need to find userland that matches... usually finding a distro that is well supported.
NetBSD supports all architectures as part of itself as a whole, no need for distro searching.
One of the cool things about BSD is that kernel and userland are bundled/tightly-coupled together as one single unit. With Linux, you need to find the appropriate distro to help you outside of the few major platforms.
You won't know until you try them out. My best advice is to download them all and fire up some virtual machines and get installing. Build each of the systems to meet your needs and see how you feel about the admin process.
For my more basic needs which is development I chose OpenBSD based on their simple, pragmatic design coupled with tight security practices in coding. Their documentation is excellent and their man pages are easy to grok and can get you 80% of the way to your goal most of the time without resorting to a search engine for help. Their FAQ pages are also full of simple, straightforward information and how-to guides that are very newbie friendly. I'm not an IT expert or unix admin, I do this for fun and as a semi serious hobby. So it's really comforting when you can type 'man networking' and figure out how to assign a static ip to an ethernet interface without having to resort to a search engine.
Hardware support is pretty good and I have it running on an older athlon x4 system, IBM T40 laptop, and my APU2 board from PC Engines (No problem installing to the SD card). Everything just works and I've yet to find a machine that can't properly run OpenBSD.
The rub is the system is more old school unix than "modern" Linux desktop. So don't expect things to be "Linux Gnome desktop easy". But it is by no means difficult to install, configure and use if you are somewhat knowledgeable with the comand line. If this intimidates you, perhaps you could go with a more desktop oriented BSD like TrueOS, a FreeBSD fork and start there. That's how I got familiar with the unix world; start with a hand holding distro and work your way down to the engine rooms ;-)
Most OpenBSD devs seem to do their development on OpenBSD-running ThinkPads, so I'd say that's a good choice.
I ran OpenBSD 6.something (wanna say 6.1?) on my work laptop (ThinkPad T470) for awhile. Only significant issue was that the keyboard would intermittently wig out when booted via UEFI (affected Linux, too; legacy booting was not affected). I ended up switching to Slackware (needed to be able to run Google Hangouts and Zoom, both of which require Linux), but I'm strongly considering switching back now that vmd is a thing (since it can theoretically satisfy my Linux-requiring needs via exposing an X server to the VM or using VNC or something).
I just got a ThinkPad X230 with an IPS screen and an i7 CPU for 180 euros. It's the last one with a non-ULV CPU, which means it's still quite fast. And it all works perfectly, except maybe the bluetooth and fingerprint reader. With a 9-cell battery you'll get easily enough hours of usage, with apmd I'm clocking around 5-6 hours, which is fine for my use.
I, like you, am quite curious about it. I've given OpenBSD a few tries and it runs quite well in a VM, but I've never managed to get it running properly with wifi. I guess it's time to give it a new go, considering there's a bunch of wifi-improvements listed.
Make sure you have a supported chipset, e.g. an intel one. Some cards need extra firmware, which you'll get in the first boot, so until that a network cable is needed.
One of the best things about OpenBSD is how connecting to the WiFi is done with ifconfig and how trivial it is compared to wpa_supplicant or NetworkManager.
Oh yeah. The docs make the process look very easy and simple. I simply don't have a well-supported card in any of my laptops. I guess I'll have to order a new one. :D
I use OpenBSD as firewall appliance, router, SSH bastion, even a general purpose terminal server that takes care of a few cron automated bash scripts.
For the typical workstation - being able to run Linux VMs, Docker/Containers are a blocker for me to use OpenBSD. The closest I have got to the OpenBSD experience is with Void linux. No Systemd, No frills minimal Linux. It is as safe/bloated/feature rich as you configure it to be.
Good to see another version of OpenBSD out. I love it for servers, the easy setup, solid package management, and security are first rate. The only reason I can't switch to it for desktop is that the Jetbrains IDEs have some issues due to no OpenBSD support Pty libraries, so debugging doesn't work, otherwise I'd be a full convert.
Still no unified buffer cache. :-( The lack of coherence and memory reuse between mmap(2) and read(2) is my single biggest beef with OpenBSD right now. It's a great system in terms of robustness, documentation, and philosophical unification. It's a shame its kernel still thinks Ronald Reagan is president.
What coherence is lacking? OpenBSD supports msync(2), which is the only POSIX mechanism I know of for ensuring coherency between read(2) and shared file mappings. Otherwise relying on unspecified behavior sounds dangerous.
Oh, come on. Every other system in common use is fully coherent. POSIX allowing OpenBSD's behavior doesn't make that behavior a good idea or a quality implementation.
OpenBSD's choice is arguably reasonable, given their prioritization of security, since it reduces opportunities for user programs to corrupt kernel memory.
What is the problem with OpenBSD's plan for coherency? Why is the burden of explicitly calling msync(2) too much?
> reduces opportunities for user programs to corrupt kernel memory
I don't see how it could. Kernel data structures don't go on pagecache pages.
> OpenBSD's choice is arguably reasonable
At a human level, the OpenBSD people have spent way too much time coming up with rationalizations for their obsolete VM design to back down now. Whether OpenBSD's VM subsystem is good or not, their pride will force them to keep claiming that it's good, practically forever.
> I don't see how it could. Kernel data structures don't go on pagecache pages.
Kernel data structures could end up on a pagecache page: all it takes is a reference counting bug and the page could be reallocated in the kernel heap, which is directly mapped by user space. Keeping user-mapped pages and pagecache pages distinct makes this less likely.
I am otherwise not convinced that there is an actual problem with OpenBSD's coherency plan.
Well, simplicity is one thing, but I was shocked to learn that it doesn't even come with the complete POSIX toolbox (e.g. out of the box awk is missing). And finding out that `ftp` also handles http and https was a bit weird too.
To some extent, I like that simplicity too (especially security wise) but I wonder if they are taking it too far.
Okay thanks, unexpected but good to know (at >340MB I would have expected a complete base system at least). Do you know if there is some up to date OpenBSD live CD somewhere?
At >340MB it does indeed have a complete base system. You just have to install it somewhere first :)
I don't know of any up-to-date prebuilt live CD/USB images, but I do know of guides to create them from another OpenBSD install (e.g. one in a VM): https://www.alti.at/knowhow/obsdlivecd/
> ROP mitigations in clang(1) have been improved, resulting in a significant decrease in the number of polymorphic ROP gadgets in binaries on i386/amd64.
Does anybody know if there's a writeup somewhere? Or what are the commits to look at.
Sorry for noob question, but why would one use OpenBSD instead of FreeBSD? I like latter, but also hear good things about former, although there are some limitations (e.g. no ZFS).
Simplicity. I have a long love for FreeBSD, but the project has different aims than OpenBSD.
Linux and FreeBSD are novels. OpenBSD strives to be a short poem.
Linux and FreeBSD push really hard to add cutting-edge features, but OpenBSD pushes hard to see what can be removed and still retain essential functionality. OpenBSD packs a remarkable amount of functionality into a code footprint that doesn’t feel like it has grown appreciably since I first ran it in the late 90s.
At the same time, this flensing process has allowed OpenBSD to move quickly on some innovations like “doas” instead of sudo. They also maintain cononical implementations of their other products like OpenSSH and were able to move quickly to their cleaned-up OpenSSL implementation LibreSSL.
As for laptop support, I wouldn’t say their hardware support compares to Linux. That is, they don’t support everything. Rather, for supported laptop (and desktop!) hardware, that suppport is excellent. Put another way: that which is supported is supported very well.
t's very compact and simple and you don't need Google to solve problems because the base system is thoroughly documented.
It has everything I need, and nothing more.
OpenBSD isn't suitable for every use case because rarely used features tend to get removed instead of falling into disrepair from lack of maintenance, but when it does work, it works predictably and reliably. I was able to run OpenBSD on my desktop and have everything work flawlessly out-of-the-box, whereas with FreeBSD I encountered frequent crashes when using dual monitors. I suppose my configuration isn't something that the FreeBSD developers use, so while it "works", it doesn't work.
In the end I returned to Linux because I sometimes play games using Steam and Wine, neither of which is likely to ever be supported on OpenBSD, but if OpenBSD provides everything you need, it's certainly worth trying it out.
* security -- the code is audited and hardened to a greater degree than any other general purpose OS on the planet (embedded safety critical microkernel systems would be the exception)
* routing suite -- one of the most well integrated open source routing suites out there (alternatives include BIRD and free range routing / quagga)
* firewall -- their firewall is flexible, fully featured, and easy to configure. It has been adopted by other BSDs, but development and new features happen in OpenBSD first.
Weaknesses of OpenBSD:
performance -- security is valued over optimized code, so the OS will not be as efficient or handle as many connections as a Linux or FreeBSD server could
* lack of ZFS
Compared to OpenBSD, FreeBSD has a slightly worse firewall implementation (originally sourced from OpenBSD), better networking and computing performance, and ZFS.
What type of device are you considering using OpenBSD or FreeBSD for?
Replying from the latest -current snapshot on my desktop (AMD Ryzen 7 / B450 chipset / ECC RAM) and have nothing but good things to say about OpenBSD. As others have iterated, this operating system is extremely reliable, secure by default, very well documented, and I have not found performance to be an issue whatsoever. Definitely recommend everyone, especially Linux users, to check it out!
The typical approach of sliding the kernel around only offers limited benefit. One leaked address and you're done.
The current approach, called KARL, relinks the kernel so that while it may load at the same address, symbols internally do not have the same offset. Learning the address of printf will not reveal the address of malloc and so forth. In the context of kernel defense, I would argue this is more effective.
Also, simply as a practical matter, the bootloader and kernel are tightly coupled in ways that make altering the load address a nontrivial endeavor.
"The difference between the two is that KARL loads a different kernel binary in the same place, while KASLR loads the same binary in random locations. Same goal, different paths."
You'd be shocked to know how long after this was shown academically to be a Good Idea™ it took to get it into operating systems like Windows. The reason back then was because application programmers depended (incorrectly!) on sequential allocations so when you started randomizing things you'd break stuff.
Idk if that's the case here but its been a big reason historically.
I know OpenBSD doesn't prioritize new features but KASLR is a pretty significant security improvement, right?
You're reading the manual upgrade guide, for remote systems where you would otherwise cannot boot the ramdisk kernel to upgrade, which handles all of that for you.
If you have console access to the machine, serial or glass. Things are far easier.
I would move them to a separate page and not delete them. Sometimes you need to know something about dealing with the ugly. Nice work and your blog is great.
In the past problems could happen if your kernel ended beyond cylinder 1024 on the disk (i386 problem)
You should have a disklabel with partitioning for at least /, /usr, /usr/lib, /var, and /home (with / fully behind cylinder 1024 for i386 Bios to be able to load the kernel via int13h )
Funny you say that. I can see your perspective but at the same time the beauty of Unix is that the OS is really just a bunch of files you can see and manipulate yourself. The system doesn’t have convoluted registry systems for instance to hold state.
So for me, deleting a few files is as good as or better than asking a package manager to do it. It proves to me that the OS is simple.
I think we have become so accustomed to complexity that now we often seek it because the simple way “couldn’t possibly be right?”
Wow this is gatekeeping if I have ever seen it before. A package manager that tracks all files installed by a distribution of software is an excellent tool, and in no way incompatible with the Unix philosophy.
I really enjoy how simple the system is after all these years with Linux. I will always continue using Linux in my main computers, but for surfing, some hobby programming and as a travel OS OpenBSD definitely won me over.
And I guess it runs quite nicely in the X250 and T450 tier already, maybe even newer ThinkPads. And when I say runs, I mean runs much nicer than many Linux distributions with their default installation.