Hacker News Reader

Comment by MrBuddyCasino | Hacker News Reader

Ha, interesting. I wonder what the rate of cross-pollination is - the BSDs should, due to their license, easily be able to use code from the other BSD variants, right? So how come that FreeBSDs pf is kinda outdated, and OpenBSD hasn't adopted Jails, too? Is it due to different philosophies, NIH syndrome or simply not enough manpower?

View on HN

The article is actually incorrect about PF. FreeBSD forked OpenBSD's 4.5 version but has provided its own set of enhancements including SMP it has fallen behind in other respects. PF in OpenBSD has had some large architectural changes that break SMP and the biggest change (new syntax) wasn't deemed worthwhile to port back to the SMP version. The blog links to an email chain about it https://lists.freebsd.org/pipermail/freebsd-pf/2014-July/007...

Some code you can just drop in, other code needs more extensive changes because the internals are different. It would be interesting to map the cross pollination, there is a lot.

I believe jails is a philosophical issue, it is very hard to show that it actually provides isolation.

> I believe jails is a philosophical issue, it is very hard to show that it actually provides isolation.

Indeed. In theory, the kernel runs at a security/isolation level above root, but in practice root can often subvert it.

That said, OpenBSD also offers rdomains, which aren't quite jails but provide a somewhat similar degree of network separation.

I'm actually a little worried about cross-pollination after I listened to BSD Now episode 52[1]. The interview with Shawn Webb scarred me quite a bit with the answer to the question at 24:08 in the video[2]. The not knowing the OpenBSD model and the whole taint code comment is not an acceptable answer when looking at another BSD licensed project. It is also a really poor idea.

1) http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover

2) This is the one time I really, really wish there was an interviewer not from the FreeBSD / PC-BSD project. I really wanted a follow-up question to this one.

You can always email the guest. We include the guest's contact details in every episode's show notes.

I love what you folks do, and your segments are spot on, and you get great people on, but I don't think me e-mailing the guy would get an answer. It was just so out-there that I still cannot figure out what the heck was up.

BSD Now and bsdtalk are the two podcasts I look forward to each week.

Reply on news.ycombinator.com