Comment by dfc | Hacker News Reader

Comment by dfc | Hacker News Reader

Parent Full thread

  > They're choosing to switch from a simple packager role to a maintainer role.

This is hardly a leap of faith for the OpenBSD developers. The dev team has always placed an emphasis on security even if the added security meant significant additional work. OpenBSD has a history of creating new software products to replace products that they deemed unacceptable from a security standpoint (including forking netbsd). I imagine that in addition to OpenBSD you are familiar with at least one of these projects:

OpenBGPD http://www.openbgpd.org

OpenNTPD http://www.openntpd.org

OpenSMTPD http://www.opensmtpd.org

OpenSSH http://www.openssh.org

This pays off for them too. NTP DoS reflection attack this year didn't work on OpenNTPD which had removed test commands and extensions that were used by attackers. The BGP hijacking going on last year sending traffic to Belarus didn't work on OpenBGPD http://arstechnica.com/security/2013/11/repeated-attacks-hij...

I think the distros shared a lot of blame for the ntp ddos attacks. The defaults were ridiculous. I want to scream every time I see `restrict default kod blah blah` without `limited`. Somewhere someone threw up that terrible restrict statement and it got copied everywhere. KOD without `limited` is useless and a good indicator the maintainer never read the docs: "If the kod flag is used in a restriction which does not have the limited flag, no KoD responses will result." As far as alternatives to the ntp reference implementation go I like Miroslav's chrony, especially for things like laptops with intermittent connectivity and power saving concerns.

Reply on news.ycombinator.com