Hacker News Reader

Comment by alec | Hacker News Reader

I used FreeBSD and OpenBSD for a while, and what drove me back to GNU/Linux was package management. OpenBSD was OK at it even if it had a limited selection, but I never had much luck with FreeBSD ports. Having a nice, stable base system wasn't very useful when ports were always being updated to the latest version; if I wanted a security fix, I had to take all the feature changes and new bugs, too. I tried a bunch of different port upgrading scripts but they always seemed to miss something. And upgrading ports took a long time; I want to be using my computer, not having my work interrupted by compiling in the background and occasional troubleshooting.

I have high hopes for Debian GNU/kFreeBSD - the FreeBSD kernel with the Debian package management.

View on HN

Binary package management in FreeBSD isn't well-advertised, but it's definitely there:

  # portupgrade -rvP --batch foo-1.2.3

This will upgrade installed package foo and anything that depends on it using binary packages from the mirror site, falling back on a build from source.

Installing a new binary package:

  # portupgrade -vNP bar/baz

If you're using portaudit to stay on top of vulnerabilities (it's part of the default install these days), here's a nice way to upgrade everything:

  # portaudit -a | sed -ne 's/^Affected package: //p' | sort -u | \
     xargs portupgrade -rvP --batch

I'm like you, for some vulnerabilities I don't want to upgrade a ton of stuff. FreeBSD is perfect for this though, you can just pop into the port directory, "make extract," apply the patch, and "make reinstall." You can avoid full rebuilds by always passing "-W" to portupgrade whenever you install / upgrade stuff.

That example of how to upgrade for security fixes is much more complicated and less reliable than Debian's "apt-get upgrade".

For example, take a Firefox or PHP security vulnerability. Those projects generally don't just release a new version with the security fixes; they'll throw in whatever feature changes they've made along the way. I don't want to sort through the various changes and patches to find the right combination; trust me, it's no fun, I worked on the Debian security team for a while. It's important to me to get just the security fixes because I don't have time for a constant upgrade treadmill and there will be new bugs in with the new features.

I really want my operating system to just work and get out of the way. If I didn't need any packages from ports, I think FreeBSD would fit that bill.

While I'm not as up on FreeBSD, OpenBSD's package management has really improved over a year or so ago - I run snapshots on my desktop, updating the whole shebang every week or two, and "sudo pkg_add -ui -F update -F updatedepends" just updates everything* via binary packages. It updates as smoothly as Debian.

Also, in 7 years, I've never had package updates break things on OpenBSD (aside from config file formats changing or postgres database transfers, with warnings at update). That happened to me a couple times with Debian (around woody).

* except for my ports that haven't made it upstream yet.

At my former employer, we had the same experience. Upgrading or installing a new package was always a pain and required you to jump through hoops while tracking down all necessary upgrades. And then it still broke. Switched to Debian, never looked back.

First time hear DNU/kFreeBSD, I have been used Debian for some years, and will try kFreeBSD later

Reply on news.ycombinator.com