Hacker News Reader

Comment by zdw | Hacker News Reader

They often share vulnerabilities with core libraries in other UNIX like systems with samba and java being two examples.

Good thing that Lion jettisons both (Samba for going GPLv3, and Java is non-core download)

The firewall functionality in OS X is impressive, but hardly utilized. The underlying technology is ipfw

Also changed in Lion, which now uses OpenBSD's pf. Apple doesn't make much more use of it though.

It has been a shame to see the sandboxing functionality introduced in Leopard not being utilized to anywhere near its full capacity.

That's changed as well in Lion, as any Mac App Store developer can tell you.

View on HN

The point he was trying to get across is that Apple shares attack surface with other Unix operating system vendors, which -- given his assessment of them as derelict in resolving vulnerabilities -- increases the harm their users are exposed to while Apple is sitting on fixes that other vendors have already written and deployed.

No piece of software is synonymous with insecurity -- except, perhaps, Sendmail. ;)

OpenBSD's pf? I highly doubt that Jordan Hubbard took the OpenBSD tree's variant. More likely it came directly from FreeBSD.

(Yes, I know that 'pf' started on OpenBSD.)

Your parentheses seem to imply that the OpenBSD team only started PF, and then let go of development, which isn't the case at all. The OpenBSD team is still the lead developer of PF, and FreeBSD sources changes from "The Source". To the best of my knowledge, there are no notable PF forks around from which the OpenBSD team can, or ever have sourced changes from, but I'd be happy to learn otherwise if you have any accounts to share.

there is no "lead developer".

Shall we discuss why pfSense is based on FreeBSD, not OpenBSD?

Because the developers of pfSense are FreeBSD users? I fail to see your point with that. And I beg to differ regarding the "no lead developer". Indulge yourself by looking at the OpenBSD changelog from release to release, year by year, and notice how every single change, minor and major, stems from there, and radiates out to, f.e., the PF port in FreeBSD.

Ah, so they get a version that is several years out of date, and uses a slightly different syntax... great.

what have freebsd contributed to pf?

don't get me stared on the lamefest that is OpenBSD

Reply on news.ycombinator.com