OpenBSD 7.3 | Hacker News Reader

OpenBSD 7.3

openbsd.org

258 pointstodsacerdoti98 comments

I've always found building/running your app code on OpenBSD (even if it's not your target OS) - makes for a better app overall because of how strict OpenBSD is - it forces your app to run "correctly" more than any other OS.

I've been able to find and fix way more app bugs, than when I ran my software on other OS'es

Any specific examples? I don't daily drive Linux but that sounds interesting.

Somewhat related, for Minecraft (Bedrock, C++) we compile with a ton of different tool chains and I really appreciate Clang versus MSVC for how strict the compiler can be (even with /-permissive).

Ted Unangst’s “Developing Software in a Hostile Environment” talk from EuroBSDcon 2019 is a good start. Controlling malloc(3) behaviour with malloc.conf to catch initialisation and Use After Free bugs is a great example from there.

Personally, a different userland and directory structure usually also beats out Linux-isms.

There's something mildly charming about fixes to ed(1) in software released today.

> Fixed ed(1) to print bytes read/written and the ? prompt to stdout, not stderr.

ed is still the standard editor.

what do you mean by standard editor

Probably a reference to https://www.gnu.org/fun/jokes/ed-msg.html

The POSIX standard defines ed as one of the editors that must be present for a system to be standard complaint, the other being vi I believe. You can always expect ed to be available to you on a Unix system.

This was initially why I learned enough of the vi keybinds to get by.

You can expect it to be there.

You can expect that on a unix system that has applied, paid and received the unix certification.

Most linux distros (and most BSDs afaik) are not unix certified.

MacOS is, for that matter.

POSIX != Unix (the certification)

It is true that all certified Unix systems follows POSIX, but it doesn't mean that non-certified systems are forbidden to follow POSIX. Most Linux distributions have ways to turn to 98% compliant, and BSDs have always strive to follow POSIX.

Weird fact: POSIX was actually named by RMS.

OpenBSD was fairly anti-POSIX in the past. I don't know if that's relaxed at all, but they very much do not chase after it.

But they do have ed, vi (plus ex), and mg (which is not standard but nice to have) in their base system.

Two of those programs predate POSIX and do not indicate that OpenBSD follows POSIX.

They are making their operating system to the design they like best. Some of it happens to coincide with what POSIX asks for, but it is merely coincidental.

I vaguely recall some interview with or blog post / talk by an OpenBSD developer, where they said that POSIX tended towards adopting whatever GNU/Linux did, and that the BSD crowd's interests were not taken into consideration that much.

I don't know much about the process behind POSIX/SUS, but I can understand how OpenBSD developers wouldn't be super enthusiastic about POSIX compliance if they felt their input was falling on deaf ears.

FWIW, I did use the SUS as my main reference when writing a few hobby projects, and OpenBSD gave me no problems whatsoever. macOS, on the other hand, which is a certified Unix, did not support barriers at the time (that was ~10 years ago, I have no idea if Apple added support since). (I know barriers are optional, but come on.)

Inspur K-UX is a Linux distribution that is officially a Unix.

OpenEuler, Huawei's version of RHEL, is also UNIX-certified.

I wonder what benefit the certification has these days. IIUC, it used to be a requirement for contracts from large corporations and government agencies, but these days the number of commercial Unix systems is fairly small, and RHEL is so common in those environments, I wonder if it there's still places where it's required.

They still have ed though, do they not?

ed: https://pubs.opengroup.org/onlinepubs/9699919799.2018edition...

vi: https://pubs.opengroup.org/onlinepubs/9699919799.2018edition...

You can see all of the utilities this way. The ex editor is also standard.

https://pubs.opengroup.org/onlinepubs/9699919799/utilities/

TIL: busybox has ed and vi but not ex. https://www.busybox.net/downloads/BusyBox.html (so ex might be nice to learn but it might be not available on common systems like OpenWRT)

Technically, vi and ex are part of the User Portability Utilities extension.

Even DOS and VMS had ed, I'm sure other OSs too.

Here: https://www.gnu.org/fun/jokes/ed-msg.en.html

And there's even a book about it, in case anyone has trouble figuring out how to use ed: https://www.tiltedwindmillpress.com/product/ed/

Love the books by mwl. Have physical copies of several of them, and the whole bunch of the ebook versions. Currently reading one of the physical copies. The one about Ed I have in ebook format only and didn’t read it yet. Will get to that one after I finish reading the physical books that I have from him.

In the old days, Unix rescue boot floppy disk to fix workstations or servers only included minimal text editors such as ed (i think vi was added later). So if you were a Unix admin or power user, you need to know ed to fix the dam system. The 'ed' text editor was available everywhere. These days rescue disks boot from USB or CD/DVD-ROM and may have a full desktops or operating systems running. A little bit of history, I guess. BTW, I prefer https://www.system-rescue.org/ these days to fix Linux bare metals.

Perhaps more important, as a line editor, 'ed' would often work when your terminal was otherwise too borked up for vi or pico to work.

Though in most cases, you can just type “reset” to reset your terminal to a sane state. If the problem is not the terminal’s state, but how software is trying to talk to it, setting TERM=vt100 (with a “reset” for good measure afterwards) usually works for most if not all terminals nowadays.

I used 'stty sane' or mucked with 'tset' directly. To many possibilities of 'reset' being aliased to something I might not want.

setting TERM=vt100 (with a “reset” for good measure afterwards) usually works for most if not all terminals nowadays

Kids these days and their 'everything is a vt100'. Perhaps true nowadays, but certainly not always (looks at his HP700/96).

Last time I checked, OpenBSD installer didn't have any editors but ed.

It comes with vi (nvi, maybe?) and mg, a small Emacs-like editor.

He means the ramdisk image, not the installed system, which obviously has ed, vi and mg. And xedit.

You just reminded me a slightly related strip: http://www.stripcreator.com/comics/elemental/605973

Every six months for the last 24 or 25 years (the web pages came after the early releases so a bit of uncertainty there. Explore for yourself at https://cvsweb.openbsd.org/www/)

And even vi gets fixes these days (Fixed handling of escaped backslashes in vi(1) ex_range).

Almost 28 years.

6.8 was released Oct 18, 2020. (OpenBSD's 25th anniversary)

https://www.openbsd.org/68.html

Nice. I ran into an nvi bug years ago... if ":set numbers" and ":set noleftright" and then loaded a file of more than several kilobytes it would go into a malloc loop and segfault. We tracked it down and submitted a patch (this was to FreeBSD) and was told patches to src/contrib were not accepted (nvi was still "owned" by sleepycat). Good to know that at a certain point, function can overtake form!

I have an OpenBSD install in a VM for the reason cited by ninjin:

> Personally, a different userland and directory structure usually also beats out Linux-isms.

I just upgraded from 7.2 with sysupgrade then pkg_add -u and it worked perfectly without any intervention from me. In the past I remember it needing a bit of tweaking and finger-crossing. Bravo OpenBSD!

I wish I could run OpenBSD on the arm64 EC2 instances. Last I checked, there's no driver for Amazon's ENA network interface.

Exciting to see some initial work to support the rk3588 soc. It has a lot of potential for use as a NAS or router or home server.

Could it support the PinePhone?

Not yet, but see this:

https://news.ycombinator.com/item?id=30019823

Your link is about the PinePhone (AllWinner SoC). neodypsis is presumably asking about the PinePhone Pro (Rockchip SoC, though not the rk3588).

From what I understand, at least two OpenBSD developers have their hands on PinePhone Pro devices. Not sure about any progress, but at least it shows that there is interest from the developer base.

Probably [1], but it certainly needs more hands on deck last time I talked to Crystal.

[1]: https://research.exoticsilicon.com/series/pinephone_openbsd

Is there much that absolutely can’t be ran on OpenBSD without dropping into code? With its history of sane security it might offer some useful applications now.

"Modern" .NET is not compatible with it (or as Microsoft would say, "OpenBSD is not compatible with .NET"), and there doesn't seem to be much interest in resolving that. For comparison, it is available from official repositories at least on Ubuntu, Fedora, RHEL, and Arch Linux, and I use it daily to build and host stuff for $DAYJOB.

I don't know about .NET or OpenBSD specifically but Mono claims to be available on all BSD platforms -> https://www.mono-project.com/docs/about-mono/supported-platf...

Is there a huge difference between that and what Mono offers?

Yes, and this is tantamount to suggesting that Python developers should be satisfied with Python 2.0 (arguably 1.0 if you do F# development). Mono is effectively dead and abandoned, and it only exists now for historical reasons.

>"Yes, and this is tantamount to suggesting that Python developers should be satisfied with Python 2.0 (arguably 1.0 if you do F# development). Mono is effectively dead and abandoned, and it only exists now for historical reasons."

There's no suggestion being made here, directly or implied. I'm asking because I have no experience with .NET and am for the most part unfamiliar with both it and Mono, but my colleagues recently spent a fair bit of time to "de-dotNETify" a large chunk of our platform and move it towards running entirely on Mono, and I figured they knew what they were doing.

The "new .NET" (which used to be called .NET Core not long ago — the whole versioning scheme is a total fiasco on their part) is relatively cross-platform, but is not fully compatible with the old one (which is only available on Windows and hasn't been updated for many years). Your colleagues probably ported an old .NET project to Mono to move it off Windows. The usual thing these days is to port old projects to the "new .NET" instead, but it isn't always possible (because full compatibility between the two was a non-goal from the start).

Anyways, as dvzk has mentioned, Mono is a completely separate project and is not a replacement for current dotnet. Last time I checked, an experimental FreeBSD port was available, but MS doesn't seem to care very much about any of the BSDs.

Sorry! I shouldn't have assumed that it was a retort. Mono's latest supported .NET framework (v4.8) is four years old, or even older if you include the general movement to .NET Core, and it only supports C# versions <= 9.0 (via Roslyn), also 2-3 years old.

msbuild, the toolchain still used by Mono, has also been widely replaced by dotnet (CLI).

It's still (decreasingly) common to use Mono for cross-platform development, especially for Unity, which hasn't yet transitioned to .NET >= 7.0.

That makes it sound like Mono has fallen behind. I would say it like this:

The original .NET platform is now called .NET Framework.

.NET Framework was ( and is ) only available for Windows. Mono is an Open Souce project to implement a cross-platform implementation of .NET Framework. In addition to MacOS, Windows, and Linux, Mono targets iOS, Android, and WASM.

Microsoft released a second .NET platform alongside Framework and called it .NET Core. Unlike Framework, Core is cross-platform, and targets Windows, Linux and MacOS.

After .NET Core 3.1, the “Core” was dropped from the name. There has been .NET 5, .NET 6, and now .NET 7 but these are all just newer versions of .NET Core.

.NET Framework is still supported but there has not been a real release in several years. Framework is stuck at version 4.x and, since .NET 5, there is really one version of .NET again ( the descendent of Core ).

As Mono implements, .NET Framework ( not core ), it still implements .NET 4.x, like the “real” .NET Framework does. Mono “only supports C# versions <= 9.0 (via Roslyn), also 2-3 years old” because those are true of the “real” .NET Framework as well.

.NET Core ( dotnet at the CLI ) has replaced .NET Framework and ( by implication ) has replaced Mono as well. That is what I think the post above is trying to say.

Except, while it is true that the “real” .NET Framework has been replaced by .NET 5+ ( by .NET Core ), Mono has not been fully replaced.

Above, I said that .NET Core targeted Windows, MacOS, and Linux. It did not target iOS, Android, or WASM ( Blazor ). Well, .NET 7 targets all those platforms. How? Well, for Windows, MacOS and Linux it uses the original .NET Core runtime. For iOS, Android, and WASM it uses the runtime for Mono!

So, Mono is alive and well inside every version of .NET since 5. It will still be there in .NET 8 as well.

That said, when people say Mono, they mean the implementation of Framework released by the Mono Project. That version, as the post above implies, is pretty dated at this point.

> .NET Core ( dotnet at the CLI ) has replaced .NET Framework and ( by implication ) has replaced Mono as well. That is what I think the post above is trying to say.

dotnet build (from the modern .NET CLI) can compile .NET SDK projects that target legacy Framework versions. A csproj with a .NET.Sdk reference can use a TargetFramework of net48 or lower.

dotnet build times are an order of magnitude faster than Mono’s msbuild command, and migrated projects also receive the recent dotnet toolchain improvements (like automatic nuget restore, among many others).

Unity projects sometimes use dotnet's csc, even when the compiled libraries are executed with the Mono .NET (Framework!) 4.x runtime.

> So, Mono is alive and well inside every version of .NET since 5.

The official mono project is no longer under active development since the acquisition of Xamarin and the reassignment of core Mono team members to .NET Core.

Microsoft’s zombification of Mono by lifting code into .NET doesn’t suddenly make it alive. We’re not going to someday get a .NET 8 reimplementation inside Mono.

As far as I've been there was some effort in .NET for BSD

https://github.com/dotnet/runtime/issues/14537 700 comments

https://github.com/dotnet/runtime/blob/main/docs/workflow/re...

https://github.com/dotnet/runtime/issues/71338

https://github.com/dotnet/runtime/blob/main/docs/workflow/bu...

This is all for FreeBSD, the only thing it has in common with OpenBSD is the shared lineage, which diverged some 30 years ago. You can for all intents and purposes treat them as completely different operating systems (like FreeBSD and Linux).

> Is there much that absolutely can’t be ran on OpenBSD

Virtual machines for non-openbsd guests? That's the only thing blocking me to fully move to openbsd.

Faq says that vmm supports Linux guests? https://www.openbsd.org/faq/faq16.html

Yes, Linux guests work. A bigger issue is the lack of hardware acceleration or passthru support for virtual machines.

Only supporting a single CPU in the guest is a significant limitation too

I had issues with some Rust-backed python libraries, last time I tried to use it in anger.

Basically anything that is not C/C++ is a pain on non linux system...

perl, python, javascript, Common Lisp, and Lua work well.

A lot of stuff works fine, but it's definitely true that C is "the" language on OpenBSD.

There seems to be a fairly low memory limit on processes, so when I tried to run a Minecraft server on my OpenBSD system, it complained about not having enough memory to start. Turns out the value seems to be hardcoded and compiled into the kernel. So... I'm not really sure how to run high-memory processes at this point, without self-compiling it in its entirety, which I don't really feel like doing.

The limits are set in login.conf, it's not hardcoded.

Tried that. There's still a limit on top of that.

That limit is 32 GiB. Hard to call it "fairly low". If you encountered a lower limit then it's something you can tune in login.conf.

Depends on what you do; I routinely use double that, and for me even my 64GB starts to be limiting.

Eight gigs was the least amount of memory I could buy this laptop with, and I'm using... 237M even with a few amfora and w3m running. Compiles will take more, but I stopped compiling horrible things like Firefox or Chromium years ago.

32gb seems pretty low? pretty routine in a lot of different domains to have processes using 10s/100s of gbs

It's not pretty low, or objectively low, but it can be considered relatively low. The average amount of RAM in desktops and laptops is still <32 GiB. From this perspective it's a very high limit.

Many servers have over 32 GiB of RAM.

Get outta here, man. No way.

I routinely work with one with 256 GiB of RAM.

And you use that one to run minecraft servers. Riiiight.

I didn't say that?

Parent was being sarcastic.

It kind of makes sense to expect 32 GB to fit every process on a desktop. But is that the main use case of OpenBSD? It would seem that the main use case would lean towards servers instead?

It's relatively straight forward to recompile the kernel. Especially compared to Linux.

https://man.openbsd.org/release#2._Build_and_install_a_new_k...

Most of the proprietary world, things like Mathematica and fast WiFi (they only support up through 802.11n, I believe), and the entirety of Steam. Things where for-profit companies make an effort to support Linux, but ignore smaller OS's. So it's a monastic experience compared to the modern Linux desktop.

(Monasteries are beautiful – still won't choose to live in one!)

> (they only support up through 802.11n, I believe)

Some newer wifi (iwx at least) work at higher speeds, but I believe this is mostly due to hardware functionality being moved to firmware. 802.11ac should be supported, but I haven't followed closely enough to know how well and in what drivers.

> hardware functionality being moved to firmware

Sorry for my lack of proofreading, this was not written correctly. Functions that were formerly handled in software drivers are now being handled in firmware by many wireless NICs.

If you do a search the number one problem or concern for running OpenBSD is performance. And I dont think much has changed. I dont doubt there are certain domain where you would value security over everything.

OpenBSD had pretty poor support for SMP for quite a while, but lots of work has gone into fixing that in the last decade. That plus how much smaller the OpenBSD footprint is than, say, Linux, and you might find these days it performs pretty well.

Is packet filtering still single threaded? I remember pf could only could only use a single core at a time which made filtering more than 1 Gb/s problematic.

It's threaded as of recently. Before that the throughput obviously hinged on single-core performance. 1 Gbit/s sounds like lower tier laptop spec to me. My 2015 low-power Celeron test rig could do ~700 Mbit/sec through a medium complexity PF ruleset on OpenBSD versions where PF was still single-threaded.

I believe it is. I will, however, admit that while I use OBSD extensively for networking devices (routers, etc.), I haven't had much call for multigig networking on them. I will say that it will easily do 1G routing+PF+VLAN on rather modest hardware (J4105, dual i211 ports).

Indeed these release notes include 13 separate sub-bullets of SMP improvements. It’s being actively worked on.

In this very release they give examples of many kernel APIs which are now unlocked.

Hardware-wise, OpenBSD (deliberately) has no support for Bluetooth.

Because their previous Bluetooth implementation was broken in various ways, and no one volunteered to fix it. So they just removed it.

About to upgrade my amd64 system.

I already upgraded my very old i386 (R51e), no issues and very easy. I am getting some mystery core dumps, will look at that later. I suspect the new "Permissions (RWX, MAP_STACK, etc.) on address space regions". but only guessing :) On the i386 I am planning on using a new "old" disk since the old disk is getting tight. Then I will worry about the dumps after an install.

edit: Fully updated to 7.3 on amd64, no issues all working perfect. Again easy no no manual configs for me.

Release engineering: Verb

see OpenBSD

When I was in college I followed FreeBSD and Solaris for a bit just to dabble outside Ubuntu and Fedora.

I remember looking for info on FreeBSD versions and wondering what the heck RELENG was.

Theo DeRaat (OpenBSD leader) did a talk on the OpenBSD release process back in 2009 [0]

[0] https://www.openbsd.org/papers/asiabsdcon2009-release_engine...

Reply on news.ycombinator.com