OpenBSD 7.4 | Hacker News Reader

OpenBSD 7.4

openbsd.org

129 pointsprivong61 comments

Open articleView on HN

Earlier submission:

https://news.ycombinator.com/item?id=37899319

Release image [1] is inspired by works of Louis Wain[2]. Name of the release image references one of his works[3].

[1] https://www.openbsd.org/images/ImHappyBecauseEveryoneLovesMe...

[2] https://en.wikipedia.org/wiki/Louis_Wain

[3] https://arthive.com/artists/11470~Louis_Wain/works/466546~Im...

I appreciate you pointing this out. While it's okay to "steal" art style towards developing one's own, it also feels great to attribute credit to the source of inspiration. None of us are anything without those who came before.

I don't think that they "stole" it. Just a nice tribute to the artist that also fits the theme. I am a fan of Louis Wain's work and just felt like sharing.

Why is this marked [dupe]? This link is the official release page, and the most active discussion for it on HN today.

Announcement mail: https://marc.info/?l=openbsd-announce&m=169746103423179&w=2

From a networking perspective, I'm looking most forward to route-based IPSec tunnels: https://man.openbsd.org/sec.4

On the Linux side these are called "vti" devices, and they're simpler to use than most other methods, and also the default when interacting with cloud service providers IPSec gateways.

What’s up with this seeming resurgence in interest in IPSec? Did Jason politically/socially mess up? Or are people realizing IPSec solves some novel problem outside the scope of WG?

I think VPNs for general use are just increasingly popular as many people have privacy concerns, many governments are interested in or actively regulating internet speech, getting around geoblocking and copyright restrictions, etc. (not to mention, very aggressive advertising by commercial VPN providers). Remote working has probably increased use as well.

I think it's great there is new attention to OpenBSD's IPSec stack. IPSec is still widely used and is the defacto VPN tech for many large corporations, even if wg is simpler and easier to deploy. IPSec tends to be built-in to enterprise routers, but I'm not sure if wg is.

> What’s up with this seeming resurgence in interest in IPSec?

IPsec is implemented on many/most network routers/firewalls, and so can be plugged into existing infrastructure perhaps.

IMHO they really need a two-step release process for changes to pf.conf syntax. In the first step you get a warning when running the service about a deprecated syntax, then drop it. Over the last 20 years I’ve been bitten multiple times by changes to pf.conf which not only breaks your firewall, but invalidates entire published books on pf, countless articles, tutorials, etc.

I read some quote from the BDFL once where he said something about breaking changes being good because you’re “in a better place” but I feel the BC breaks are too aggressive to rely on pf directly in anything but small commercial applications. If you want to to tinker and break your home network fine.

This is why the upgrade guide says to actually read the changelog; they tell you the changes. I've only been bitten once, and it was because I didn't read first.

>> Read through and understand this process before attempting it. For critical or physically remote machines, test it on an identical, local system first.

>> Read configuration and syntax changes and the package upgrade instructions. There were several configuration changes and changes in packages that may require planning before starting the upgrade.

Typically you don't have breaking changes for a point release.

For OpenBSD at least, every release has equal weight and always increments by 0.1. There isn't a distinction between major and minor releases like other projects have. There are patches/errata, but those don't bump the version.

Theres a reason they call it an system upgrade, and not a patch or update. Blindly upgrading anything important without rtfm is just plain irresponsible, yet OP has used openbsd for 20 years and keeps making the same mistake over and over; typically you don't do that.

The best way I've seen is to have the upgrade itself migrate the config, when at all possible.

Sometimes it can't be done, because the changes are entirely orthogonal, but trying your best is quite helpful.

Or you just do like Linux apparently seems to do and introduce a new software firewall every few years :D

Aww, I was most excited about the release song! Is it not happening anymore?

OpenBSD 7.2 did not have a release song, but OpenBSD 7.3 did.

https://www.openbsd.org/72.html

https://www.openbsd.org/73.html

Likewise there has been several other versions that did not have songs either in the past.

https://www.openbsd.org/lyrics.html

So probably there will be more songs in the future too, even if not every release has a song.

Also looking forward to artwork merch but that's still for 7.3 on their shop, maybe it will be updated in a few days?

I still miss buying CD sets. I understand why the project doesn't do it anymore (lots of effort and time, similar to why VAX was dropped), but it sure was fun getting them in the mail and using official discs to install.

Why was this marked a dupe? Both were posted about the same time, but this one actually has upvotes and discussion...

What people use for hardware now that pcengines' apus are eol?

I've been using a NUC! My only "complaint" is that the model I'm using only has 1 built in NIC, had to add another via USB. It works very well.

You could use VLANs and ditch the extra USB NIC if you want.

I ran such a topology for a while, aka "router on a stick". I had a two-port trunk link to a cheap Cisco small business switch, it worked great. It could also have been easily virtualized with a single virtual NIC, but I don't like virtualizing my router anymore, hah.

Protectil VP2420 here.

I'm curious to hear others' answers to this question as well. I've been looking into building my own OpenBSD based home router and so far thinking a Protectli Vault [1] would fit the bill.

1. https://protectli.com

EOL as in "no longer sold" or "cannot install new openbsd releases on them"?

https://www.pcengines.ch/eol.htm

They're no longer produced but still serve as a perfectly capable home router. Even my previous APU 1 is still a rock solid performer.

What's the situation wrt the install process? I remember having to use a non-official distribution of OpenBSD.

It should be completely possible using only the official install media, then and now. To do this today, download the AMD64 install74.img (like an ISO, but for flash media), write the image to a USB disk, connect to the APU1/2 via serial, plug in the drive and power up the APU, then follow the installation script.

Once booted, run fw_update and syspatch to make sure the firmware and system is up-to-date.

I don't think OpenBSD supports it, but the Traverse Ten64 has ten gigabit Ethernet ports, eleven antenna mounts, and up to 32GB of ECC RAM:

https://www.crowdsupply.com/traverse-technologies/ten64

I was recently looking at some Banana Pi boards, but I'm not sure if any of them other than the R1 will run OpenBSD. HardKernel's ODROID-H3 is tempting, but the cases are not great looking.

They state on their webpage that they have bought a lifetime supply of those chips. I wouldn't call them EOL

As I have none, it is for me.

OpenBSD supports Ubiquiti's octeon processor. I thought it would be neat to run my router on a non-x86 CPU, but I don't have personal experience with these boxes yet.

https://www.openbsd.org/octeon.html

I love how OpenBSD continues to support and fix issues on a wide variety of hardware. I personally run it on various machines, from Pentium MMX (1997), AMD K6-3 (1999), to modern machines. 486 support was dropped just a couple releases ago, and was supported longer than VAX.

> Fix a bug in the handling of SCSI drives in the bootloader on the luna88k architecture.

> Correct undefined behavior when using MS-DOS filesystems, fixes imported from FreeBSD.

> On arm64, use the deep idle state available on Apple M1/M2 cores in the idle loop and for suspend, resulting in power savings.

> Update AMD CPU microcode if a newer patch is available.

OpenBSD has a reputation for being super secure but are there any big organizations that actually use it for security critical applications? A quick search shows outdated or non-related results.

That reputation was and still is propagated by OpenBSD fanboys.

When put to scrutiny OpenBSD fails the same way any other operating system does(https://isopenbsdsecu.re/about/)

OpenBSD is secure in the default install; it's just that their default install has basically had everything turned off since forever.

Mind you, that was a great improvement over things like Windows NT, but "this is super secure as long as you don't do anything with it" is not as incredibly useful as it sounds like at first.

I like having to install the things I really want, which gives me a chance to consider the security implications of them, instead of having many things pre-installed and I don't know what the total risks are. And nothing else I know of has gone since ~1996 with only 2 of the worst kind of security holes (i.e., remote exploit of something I didn't even need, but was installed by default).

In the base install are many useful things (including a web server IIRC, though the port is not exposed by default), and those are audited and have that excellent track record.

Then when you install extra things, they are usually limited by what user they run as, and usually have pledge/unveil run (limiting access to predetermined/approved syscalls and parts of the file system) so they can't break other things if compromised.

I have read that many security innovations [1] get implemented in OpenBSD soon, like W^X [2]. But I don't know enough about OpenBSD and I would like to hear as well if any organization uses it for mission critical applications.

[1] https://www.openbsd.org/innovations.html

[2] https://en.wikipedia.org/wiki/W^X

That site is great!

This site states that its main reason for not working with the openbsd community is they don't like their politics.

I'm possibly motivated by different reasons than other users but I think an understated feature of OpenBSD is that it's simple

The unique security features are nice but really there's a lot to say about how simple an OpenBSD system is to use and configure.

Simplicity is security. There are less things that can go wrong.

It's like a scene from some movie, there's a hacker in a dark room, connects to some machine deep inside of mega corp and the login prompt comes on screen...

    Connected to 123.4.002.312
    Welcome to OpenBSD 6.2!
    
    login:

Hacker: Dammit, it's an OpenBSD system. We'll never get in!

I've seen it used before commercial security/networking appliances got "good" (generally pre-2010ish), but I think its use has diminished. I was a huge OpenBSD user back then as the networking (routing/firewalling/etc) was so simple AND powerful. I stopped when screenOS and later Juniper matured to the point where updates were just uploading firmware and hardware upgrades were just dumping the old configs in.

I knew it was deployed at a few non-tech oriented fortune 500 companies (eg not banks or tech firms) as last as 2016, but I've been out of that market since.

More secure than what?

Given the world runs on Linux servers, its pretty obvious that is probably the most secure.

Outside black boxes like M$ and Apple, FOSS OS level seems quite secure. How often do you see Linux malware caused by OS in the wild? Sure you install wordpress and never update it and get a cryptominer installed, but its not like anyone is pinging a server with a picture and an overflow error is causing a Pegasus exploit.

> Given the world runs on Linux servers, its pretty obvious that is probably the most secure.

That's not obvious at all, and judging by CVE rates appears to be untrue.

Actually it makes their point. Linux is super widely used, meaning it has millions of eyes on its codebase and it's a very high value target for both attackers and security researchers. OpenBSD is just a LOT less used, meaning that there might be latent security problems that no one bothered to uncover. It's very easy to have less CVEs when you are used less, that's why I have some doubt about the "secure" reputation it has.

Sure, market share is an argument that Linux might get better checked, but considering it an "obvious" foregone conclusion is unsupported.

Their reputation is very much exaggerated. It came from the early 2000s where they were 'secure by default' simply for not having services enabled.

They have done a lot of good, but they primarily equate security with code quality which is very short-sighted.

I think high quality code equates to better security, even though such code is not by itself a panacea for security.

Here's a neat resource for OpenBSD's mitigations, some of which were/are novel, though it may not have been updated recently (2019):

https://isopenbsdsecu.re/mitigations/

High quality code reduces instances of vulnerabilities, which is great. But code vulnerabilities are only one of the many factors in assessing security.

To be considered a secure operating system, you need to have more mechanisms in place to protect against various threats, and the OBSD developers actively resist that. I'm familiar with their innovations and solutions, and I think they fall far short.

Here is another list: https://www.openbsd.org/innovations.html

I liked this one

* Do not calculate IP, TCP, and UDP checksums on lo(4) interfaces.

so, a tcpdump/wireshark trace on lo will now show all packets as red/bad? That sounds annoying.

But I get why they did it, it probably makes sense in most real-life scenarios

This is the commit for those curious: https://github.com/openbsd/src/commit/c778c0d73570b51def4f06...

> Packets sent over loopback got their checksums calculated twice. In the output path they were filled in and during TCP/IP input all checksums were calculated again to be compared with the previous result.

Avoid this by claiming that lo(4) supports hardware checksum offloading. For each packet convert the flag that the checksum should be calculated to the flag that it has been checked successfully. Keep the flag that it should be calculated for the case that it may be bridged or forwarded later.

A drawback is that "tcpdump -ni lo0 -v" reports invalid checksum. But that is the same with physical interfaces and hardware offloading.

OK dlg@

Why use an old version of ffmpeg?

What is the use of ed25519 x509 TLS certs, which TLS clients support that and which CAs would sign that?

Reply on news.ycombinator.com