Hacker News Reader

Comment by user3939382 | Hacker News Reader

I’ll use OpenBSD again if and when there’s a long-term branch that freezes the pf.conf syntax, let’s say for 10 years.

Of course people are free to run their volunteer projects however they like, but I’m also free to decide that I’m not going to have my firewall rules randomly break if I want to keep my router updated. Over the last 15 years or so I’ve been burned by OpenBSD multiple times on this issue.

View on HN

Every OpenBSD release comes with a comprehensive, release-specific upgrade guide which tells you all quirks (including changes to configuration syntax). For this version, you can find the respective doc here: https://www.openbsd.org/faq/upgrade71.html (Note the entire section called "Configuration and syntax changes")

There's also a pretty clear instruction at the top: "For critical or physically remote machines, test it on an identical, local system first."

I mean, I know it's annoying to hear that, but they are pretty upfront about basically everything with this OS, and you just have to be diligent about actually reading the documentation for the system upgrade. You were not "burned" by the OS or its developers.

All the changes are mentioned in changelog and/or upgrade guide. What's the story here?

Reading is hard /s

Yeah try reconfiguring a remote firewall with breaking changes and therefore new behavior without OOB access. Don’t make a single mistake or you could be traveling hours/days.

Good luck with your “reading” now that the breaking changes have made hundreds of online tutorials, articles, books etc that would guide you obsolete and wrong.

So if you skip testing, and you skip reading the upgrade guide, skip editing pf.conf to adapt to some upcoming change and reboot into the upgraded OS version, you will still get a default pf that allows you to ssh in and fix it.

But sure, one can still shoot oneself in the foot if you aim for it.

Reply on news.ycombinator.com