OpenBSD 5.9 | Hacker News Reader

OpenBSD 5.9

openbsd.org

81 pointsbased226 comments

Hilariously these releases are apparently accompanied by songs with choruses that make reference to "secure by default" http://www.openbsd.org/songs/song59b.mp3

To me, there's nothing quite like the feeling OpenBSD offers you of running `ps -ax` and seeing a nice, clean, minimal list of essential processes.

It is the same with NetBSD, which I love, although it annoys me that Inetd is turned on by default.

Generally, very little is "turned on by default" which sets this OS apart.

Where are you getting your rc.conf?

This looks reasonably conservative: 1 line.

/pub/NetBSD/NetBSD-release-6/src/etc/rc.conf:

rc_configured=NO

You're looking in /etc/rc.conf instead of /etc/defaults/rc.conf

http://cvsweb.netbsd.org/bsdweb.cgi/src/etc/defaults/rc.conf...

Don't get me wrong, I am not complaining - but why is this news (again)? 5.9 came out, what, two weeks ago.

On the other hand, who doesn't love OpenBSD news.

So today allow me to point out that since I am a sysadmin at a mostly-Windows shop, I really like how modest OpenBSD's hardware requirements are. If you keep the workload appropriately modest, it can run on 128MB of RAM (probably a lot less, I did not try that hard) on a hard disk that is smaller than Windows' installation DVD and perform useful work. Obviously, the comparison is not without problems, but it comes in handy to explain to people why in some ways I am astonished that you need a dual-core CPU with 8GB of RAM just to run Outlook, Excel and a remote desktop session.

Yeah I run OpenBSD on an absolutely ancient Atom-based Dell netbook as a beater machine to carry around when I need a portable terminal. With a minimal wm it's surprisingly usable on a machine that was considered underpowered even when it was new, though Firefox chugs and stutters a bit.

Is it just me or is OpenBSD's ldapd the only LDAP server with bcrypt password hashing built-in?

I've seen extensions/plugins for the other guys, but not built-in

Also, nice to see pledge in the smtp server and mutt, and ChaCha20 in IPSEC

Huh, I was not even aware OpenBSD had an LDAP server in the base system. ... Apparently, the Internet tells me just now, they have had it for a while now. Who would have known?

This makes me think of a comment I read around the time of the 5.8 release to the effect that with any other project this would reek of not-invented-here syndrome, except that the OpenBSD people have such a superb track record for getting things right. ;-)

This release brings 802.11n into the kernel, and, of course, pledge in all coreutils and chromium! :D

All correct, except BSD doesn't use GNU coreutils.

why are the gcc and llvm versions so old? everything else seems recent.

OpenBSD's base gcc is a fork of the last GPLv2 version, like Apple and embedded except with many local changes, e.g. gcc-local(1):

http://man.openbsd.org/OpenBSD-current/man1/gcc-local.1

There's newer versions of gcc in ports, llvm/clang was recently updated to 3.7.1, post 5.9.

The last GPLv2 GCC is 4.2.1. OpenBSD has 4.9.3 (they also have 4.2.1 and 3.3.6). Why not 5.3? Why was clang updated post 5.9? How long do they take to stabilize a release?

OpenBSD releases on a 6 month cadence, and they don't typically hold a release to fit something in at the last minute. I think they finalize the release well before the release date too; 5.9 was released on 3/29, but the errata page[0] shows 3 issues with patches from before that date.

[0] http://www.openbsd.org/errata59.html

Here's a Theo de Raadt talk on the OpenBSD release cycle, for those who are curious.

https://www.youtube.com/watch?v=i7pkyDUX5uM

GCC changed their system for numbering versions with version 5.

GCC 4.9.X [1] was the stable branch first released on 2014-04-22 with latest patch 4.9.4 released on 2015-06-26.

GCC 5.X is the next stable branch first released exactly a year after 4.9 on 2015-04-22 with latest patch 5.3 released on 2015-12-04.

LLVM 3.5 [2] was released on 2014-09-03, latest patch 3.5.2 was released on 2015-04-02.

LLVM 3.6 was released on 2015-02-27, latest patch 3.6.2 was released on 2015-07-16.

LLVM 3.7 was released on 2015-09-01, latest patch 3.7.1 was released on 2016-06-05.

6 months before the 2016-03-29 release of OpenBSD 5.9, i.e. at the end of September of 2015, GCC 5.2 was the stable version, not GCC 4.9.3, but they chose GCC 4.9.3. LLVM 3.7 was the stable release, but they chose 3.5 (I hope it's 3.5.2 though it doesn't say).

So, OpenBSD's compilers are the stable branch from ~14 months before the release, with relevant updates applied. Not Debian, but not Arch either.

1 - https://gcc.gnu.org/releases.html 2 - http://llvm.org/releases/

OpenBSD isn't the only system that's avoided gcc5 due to the breaking C++ ABI changes.

Which bring lots of fun when trying to use binary builds of Swift, for example.

Do you mean linking C++ .so built by gcc5?

No just plain Swift.

For example the binaries for Ubuntu 14.04 don't work if the newer GCC is already installed.

Swift compiler will fail to find the modules due to an ABI error as it will interpret the function call results from libstd++ as failure.

The workaround is to re-compile everything with the new version.

I don't know much about Swift, so please excuse my ignorance. Are these modules .so files, written in C++, linked by the system CXX (gcc5), and therefore unusable by Swift which was linked with Clang itself, or what's the technical explanation?

The Swift runtime library is currently partially written in C++.

I see, and in what scenario does it try to load a C++ .so built with gcc4? I'm sure this happens, but I'm curious what scenario it is on a distro where stuff shouldn't be partially built with g++4 and other stuff with g++5. I ran into the issues and am interested in the details as a way to avoid it myself.

This is the bug:

https://bugs.swift.org/browse/SR-23

OP I believe you meant to say “q.v.” instead of “e.g.”

Reply on news.ycombinator.com