Hacker News Reader

Comment by user3939382 | Hacker News Reader

My main use for OpenBSD is as a firewall/router, and they frequently make breaking changes to the pf rule syntax so I had to abandon it. Last breaking change when I checked was July, but it's been going on for many years. If you have one firewall no big deal, but if you set them up for customers all over the place it's a nightmare. They should take a page out of Microsoft's book here.

View on HN

"My main use for OpenBSD is as a firewall/router, and they frequently make breaking changes to the pf rule syntax so I had to abandon it."

Uhm... well, I've been using it since 3.0 (when pf was introduced) and its been very stable. You have at least 6 months to convert your pf and its never taken me more than a day to get it changed. Its well documented and frankly, even with all the horror stories, I've found friendly help each time I had a question (do read the manual before asking a question). Looking at your firewall rules every 6 months isn't exactly stressful.

I don’t think most people would agree that breaking changes every 6 months fits the definition of “stable” for a firewall.

They don't change it every six months. You look in the release notes and check if anything changed. Heck, there have been years where no changes were required.

Breaking changes do not occur every 6 months. The OS is upgraded every 6 months. Sometimes there are new features. Once in a while a line or two in your pf.conf may need to be changed as a new feature is added.

Frequently is very subjective. Sometimes you have to make way for progress. I’ve been using pf since 3.0 and the syntax changes have been minimal and, I’d say, always for the better and to make a drastic improvement.

>They should take a page out of Microsoft's book here

Yeah NO.

OpenBSD is the opposite of backward compatibility by design.

You should have known that before installing at your customers site en masse.

That's probably one point why PFsense is based on freebsd and OPNsense on hardenedbsd.

^^ The wording of this response represents exactly why many people don't choose OpenBSD.

Let that not hear Linus and his wording.

They make a good point though. OpenBSD is not known for it's stability.

I was referring not to the content of the comment, but the wording of its delivery.

That one?

>>They should take a page out of Microsoft's book here.

or mine?

>You should have known that before installing at your customers site en masse.

Sorry for stating a fact that you should know your OS before sprinkle it all over your customers.

Honestly that is a compliment. When it comes to evaluating tech, the best statements are those where you can walk away knowing very clearly that yes, this meets my needs, or no this absolutely does not meet my needs.

Yes, but you say that as if it was a universally bad thing. OpenBSD is largely made by its developers, for its developers. It has its own unique culture and does not seek mass appeal. To many – such as myself – this is refreshing, in particular when you contrast it to how poor open source developers are scolded on GitHub by entitled users for not putting in more of their free labour to satisfy their requirements. Is it for everyone? No and that is fine. You are always free to fork it or enjoy the fruits of their labour from a distance, such as with OpenSSH, tmux, etc. that work just as well for OSs which may have a culture closer to your taste (and that is also equally fine).

> OpenBSD is largely made by its developers, for its developers. It has its own unique culture and does not seek mass appeal.

I wish these kind of caveats were highlighted more often, not only when it comes to OpenBSD but also when it comes to anything regarding Linux. Instead, you have people defending why the way how OpenBSD works is the "right" way.

I'm honestly somewhat surpised at seeing how much people are attached and married to their tools.

Indeed.

Last time I gave a look at OpenBSD I immediately noticed a huge courtain of gatekeeping around pretty much anything.

Meh.

Why don't you check NetBSD's npf? It's not yet as featured as pf but will be. And NetBSD is a very stable system.

Reply on news.ycombinator.com