Hacker News Reader

Comment by justin66 | Hacker News Reader

This seems like a big deal:

One thing to note: this will be the last version of OpenBSD to be pressed on CD. The project will now focus on internet-only distribution, giving much more flexibility in the release schedule.

View on HN

It does? I was under the impression the only reason anyone still did that was to give something physical to donators.

Perhaps I'm the only person using computers in 2016 who only installs OpenBSD via CD :-)

I still install all my OSes via CD/DVD but I burn them myself from an ISO.

I haven't even owned a computer with a CD/DVD drive in over 10 years.

One thing that drives me mad is that computer manufacturers still distribute recovery images as DVDs, even though the computers the discs are for don't have drives.

USB CD/DVD drives exist

Yeah I know, it's just annoying to own something you'll need once every 2 years or so.

In fact, I prefer to own something that I use once or twice a year (and between different computers at that), and then store in a box somewhere, rather than having a piece of computer suck in dust and whatnot all the time.

Not exactly a counterpoint to what you were saying, but somehow related.

Such as re-installation DVDs

I only do to enjoy the pleasure of old ways. Interacting with CDs and CD drives reminds me of when it was cutting edge. Tray mechanics, the speed intake of spinning motors. Even the latency and seek sounds. And somehow, the (almost since it's on DVD RW) immutability. In some ways, the sheer speed of SSD is ... boring when you're not in a hurry.

ps: a bit like vynil lovers who take their player out for similar reasons.

I do that too. I also like to imagine a post-apocalyptic, no-internet time where I have a generator, PC, BSD disk and the knowledge to use them to rule the new world while everyone else is stuck on the "Activation Required" screen.

Fortunately OS X isn't as bad as Windows. I haven't tried the most recent version, but for previous versions I have successfully installed OS X from a USB stick, without needing any internet access at all.

However, the OS X binaries are signed. So, when the key expires, people are SOL. I had this problem, and easily re-downloaded my various older OS X versions. But in the general case it's quite disturbing: http://www.macrumors.com/2016/03/03/older-os-x-installers-br...

Reminds me of my old faithful Amiga, and its 3,5" floppy drive...it made a distinct, almost musical sound. You just turned the machine on and that famous splash screen would appear, then the empty drive would start ticking regularly, waiting for an 880Kb disk. As soon as a disk was inserted, you could hear its typical seek noise while the system booted, track after track...

And the famous click of death.

I can recommend an offline install of Debian using the DVD1, DVD2 and DVD3 binary iso images. No need for an Internet connection.

Depending on the software you wish to install, you will be swapping between the DVDs a few times (e.g. texlive/gnuplot/r-base).

So far as I am aware, Debian is the only distribution that provides a fair chunk of the packages available in the (main) repository for effectively offline installation.

SLE (and RHEL) do too, and I think that openSUSE Leap does as well (but I don't think that it's visible from the main download page).

Thanks, I'll check the openSUSE Leap arrangements.

Damn, I just double-checked and it looks that I was mistaken[1]. I'll send an email to opensuse-project@opensuse.org to see if there's a reason we can't produce ISOs like that. Since both SLE and openSUSE use OBS (the Open Build Service), it should be possible to publish those images without much issue.

[1]: http://download.opensuse.org/distribution/leap/42.1/iso/

Here's the thread: https://lists.opensuse.org/opensuse-project/2016-09/msg00000...

So at present, offline installation with a reasonable package selection is Debian off the shelf and Slackware with a carefully curated cache of slackbuild produced binaries.

I suppose one could cache the OpenBSD package binaries and point pkg_add to the relevant storage media to make a third option.

You could also cache the openSUSE packages as well (zypper allows you to add any directory as a repo). If you _really_ wanted to do it, you could do a recursive copy of http://download.opensuse.org/distribution/leap/42.1/repo/oss... with wget and then point zypper at that directory.

I install it from the ramdisk, much better.

How? How can you make a ramdisk resistant to a reboot?

You don't need to. It's created a-fresh for you when you boot bsd.rd. After you're done installing, you don't need the ramdisk as you'll boot your newly installed bsd kernel.

Are you referring to the upgrade method described here [1]?

[1] https://www.openbsd.org/faq/faq4.html#bsd.rd

The last couple installs of any OS I've done have been a few off of USB and the rest off PXE.

Don't forget the awesome stickers!

Yeah, and even the packaging. The latest release (5.9) was the first "official" OpenBSD CD set I ever bought, and I was astounded by the quality of the set, from the packaging and inserts to the discs themselves. I don't know why, but I didn't expect it to be so... professional. I pre-ordered this release, too. I like being able to help out the OpenBSD project financially and get something nice out of it. Oh, well. RIP, OpenBSD CDs.

CDs are read-only, whereas a USB stick has (generally insecure) firmware that can be modified. So in a setting where the user is concerned about persistent USB malware, it can make sense to use them.

It's a niche concern of course, but I suspect it's a little bit more common in the OpenBSD community than in many others. Of course it shouldn't be too hard for those users to build their own install boot CDs with the tarballs for installation, just skip the big package sets and install them later if the whole won't fit on the disc.

What happens if your cd that comes in the mail is swapped out for a different cd by a malicious actor?

You check hashes (from the web site) after you copy the files to media you trust, and then any tampering is really interesting . . .

You can find well-known hashes to check your install media with online (assuming you can trust the media because it comes wrapped up in a nice package is a bit naive...). What you cannot check however, is a USB key firmware (ring-0?) malware, that lives completely outside of disk space, and thus is beyond reach, but might have limited (or even complete) access to the system it is plugged to. CDs and DVDs (don't know, but perhaps SD/compact flash/etc. cards too?) are thus the last mainstream media that come with 'no firmware attached'.

> What happens when a malicious actor leaves physical evidence all over?

They get caught.

The flexibility in the release schedule strikes me as very useful. The CD sales business is admittedly less interesting.

One nice thing about the physical CDs is that they're trustworthy source for the release's signify pubkeys (which you can compare with the ones on the website.)

What if someone tampers the CD before it is delivered to you?

It is - I did not know this. I purchased a USB-DVD player for the sole purpose of getting a physical delivery of OpenBSD. Sad to see it go by the wayside.

I can't tell if this is a joke.

it is not a joke. http://www.openbsd.org/lyrics.html#60f

How did I not know about these songs? How?

Which part - buying a USB/DVD player just for OpenBSD? In three+ years that's literally the only thing I've used it for. Nothing else.

The part about OpenBSD 6.0 not being on CD? I have no idea - this is the first I heard about it. Couldn't really find anything on the site either other than the song lyrics referenced above...

I thought the (forced) schedule was considered a feature, to allow users to know when to expect updates and to have developers know when work had to be finalised for inclusion in the release.

I enjoyed receiving the CD package and the associated artwork.

Reply on news.ycombinator.com