Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Operating Systems Security Unix BSD

OpenBSD 5.0 Unleashed On the World 185

Posted by timothy from the sir-this-encryption-appears-nearly-unbreakable dept.
First time accepted submitter tearmeapart writes "A new version of the operating system that most of us would love to love, but probably hardly ever directly use, has been released. As scheduled, release 5.0 brings support for more hardware, network improvements, and OpenSSH 5.9. The links: changelog; download; main 5.0 page; and how to order your OpenBSD products!"
This discussion has been archived. No new comments can be posted.

OpenBSD 5.0 Unleashed On the World More

OpenBSD 5.0 Unleashed On the World

Comments Filter:

  • EPIC headline (Score:3)

    by seandiggity ( 992657 ) on Tuesday November 01, 2011 @12:24PM (#37908892) Homepage
    ...no but srsly, OpenBSD is not actually a giant blowfish out to destroy our cities.

  • Comment removed (Score:5, Informative)

    by account_deleted ( 4530225 ) on Tuesday November 01, 2011 @12:24PM (#37908898)
    Comment removed based on user account deletion

  • Install media? (Score:2)

    by raydobbs ( 99133 ) on Tuesday November 01, 2011 @12:28PM (#37908940) Homepage Journal

    I remember trying to install this back in the 3.0 days, being thwarted by the fact that one of the authors of the software owned the copyright on the OS in ISO disc format, effectively making it impossible to get a version to install without paying him. After a few failed days of missing this or that file, and corrupt BitTorrent copies, I gave up, went back to FreeBSD (at the time).

  • Wow! KDE 3.5 and Gnome 2.3 .... (Score:2)

    by Jerry ( 6400 ) on Tuesday November 01, 2011 @12:34PM (#37908986)

    It's Linux, direct from 2005!

  • Oh boy. (Score:2)

    by Hatta ( 162192 ) on Tuesday November 01, 2011 @12:53PM (#37909180) Journal

    I get to rebuild my firewall from source yet again.

  • Hardly ever use? (Score:1)

    by Ptolom ( 2191478 ) on Tuesday November 01, 2011 @01:13PM (#37909466)
    My server runs OpenBSD. It has a really good firewall, and it's absurdly secure. I'm not enough of a masochist to run it on a desktop but if you configure it properly it makes an excellent server OS.

  • Not provably secure (Score:1, Flamebait)

    by kriston ( 7886 ) on Tuesday November 01, 2011 @01:14PM (#37909486) Homepage Journal

    OpenBSD is only perceptually secure. There is no unbiased audit process. There is no verification by a third party. There's just narcissism. The only reasons we think OpenBSD is secure are:

    1) OpenBSD supporters said so.

    2) Few people who say they use OpenBSD actually use OpenBSD. As a result, few security holes are found and published.

    Please prove this wrong. All I'm seeing are various forms of cognitive distortion and fallacies when people try to prove to me that OpenBSD is truly more secure.

    • Re:Not provably secure (Score:1)

      by Ptolom ( 2191478 ) on Tuesday November 01, 2011 @01:18PM (#37909542)
      It's quite tricky to prove you wrong, but easy to prove you right. (if you are right) Just find a remote exploit or two.

    • Re:Not provably secure (Score:2)

      by hedwards ( 940851 ) on Tuesday November 01, 2011 @01:30PM (#37909702)

      You're wrong, because of the claims and the track record, finding a vulnerability in the base install is a great way to make a name for oneself as a security researcher. In the last decade only one has been found. Which is pretty damn impressive by any standard.

      Probably the only better way of ensuring that level of security would be paying out a million dollars for such an exploit.

    • Re:Not provably secure (Score:4, Informative)

      by MikeBabcock ( 65886 ) <mtb-slashdot@mikebabcock.ca> on Tuesday November 01, 2011 @01:40PM (#37909840) Homepage Journal

      If its security is important to you, you're fully capable of funding your own audit from a third party, either solo or as a group effort. Put together a requirements list, find out a price, and start asking others to chip in until you can afford it.

      You're also free to Google for "OpenBSD exploit" and look at all the (very few) results for actual remote exploits.

      OpenBSD has always had much more intelligent (secure) default settings for its installed services and packages than Linux or Windows, but I don't administer any OpenBSD boxes regularly myself because its a bit of a pain for day to day patches and updates compared to Linux. There's a trade-off to be made between security and hours available in the week.

    • Re:Not provably secure (Score:1)

      by Anonymous Coward on Tuesday November 01, 2011 @02:05PM (#37910130)

      ...did you use SSH today?

    • Re:Not provably secure (Score:5, Insightful)

      by Uberbah ( 647458 ) on Tuesday November 01, 2011 @02:18PM (#37910274)

      The only reasons we think OpenBSD is secure are:

      1) OpenBSD supporters said so.

      So we should all realize that OpenBSD is overrated. Because you said so.

      • Re:Not provably secure (Score:2)

        by LWATCDR ( 28044 ) on Tuesday November 01, 2011 @05:36PM (#37912848) Homepage Journal

        Actually yes you should.
        He did not say that it wasn't secure he said that it wasn't provably secure. They say they are secure but their has been no third party testing or auditing of the code so It all comes down to "We are secure because we say so."

        OpenBSD does have a very good track record but that could be in part luck or just that they are a small target. It could also mean that it is that secure but without a security audit by a third party it is all just taking the developers word for it.

        • Re:Not provably secure (Score:2)

          by iggymanz ( 596061 ) on Wednesday November 02, 2011 @12:44AM (#37916238)

          A small target? Their security wares (including openssh and openssl) are used by almost all the Unix, BSD, Linux. and by major companies (cisco, juniper, HP, etc.). That makes some of the wares of the OpenBSD team a HUGE target. Now where will you find the most secure implementation of those wares in an operating system?

          • Re:Not provably secure (Score:2)

            by LWATCDR ( 28044 ) on Wednesday November 02, 2011 @11:00AM (#37920460) Homepage Journal

            So?
            First OpenSSL are a separate project.
            Second their is more to an OS then SSH and SSL.
            Third do you know what provably means? Until you have a formal 3rd party code audit it isn't provably secure. It could be the most secure OS on the planet but it is that provable part that OpenBSD is lacking. If OpenBSD had good support for ZFS I would be tempted to use it on a NAS because it does have such a good track record.

            • wrong!!!! (Score:2)

              by iggymanz ( 596061 ) on Wednesday November 02, 2011 @05:13PM (#37925696)

              I was referring to the OpenSSH and OpenSSL implementations that the OpenBSD team developed from scratch.

              • Re:wrong!!!! (Score:2)

                by LWATCDR ( 28044 ) on Wednesday November 02, 2011 @05:44PM (#37926116) Homepage Journal

                Remove one and renumber the rest then. WRONG!!!! Still not provably secure.

                • Re:wrong!!!! (Score:2)

                  by iggymanz ( 596061 ) on Wednesday November 02, 2011 @07:54PM (#37927884)

                  Yes, "real world" provably secure rather than your "ivory tower knothead" secure. The thing has stood the attacks of the wild, and has the admiration and use of experts in the field. the kind of audit and certification you are talking about means nothing, suppose the pathological liars of Gartner commissioned some agenda-driven study.....

                  • Re:wrong!!!! (Score:2)

                    by LWATCDR ( 28044 ) on Thursday November 03, 2011 @10:20AM (#37934236) Homepage Journal

                    Real world provable?
                    Dude get you panties out of a twist. I never said that OpenBSD was terrible or that it's security sucked. Heck if it supported XFS well, I would be tempted to use it for a SAN or NAS because it has such a good track record.
                    Mindless fandom like you exhibit is unprofessional and frankly hurts the reputation of OpenBSD.
                    I am sure that the OpenBSD team would love to have someone pay for a third party security audit of their code. I can understand that it is expensive and they do not have the resources to pay for it but without that you just have to go on their track record. Thing is that just because the last version is secure that doesn't mean this one is. Past performance is NOT a 100% effective predictor of current performance and past performance does show that they can make errors.
                    Dud take a deep breath and calm yourself.

    • Re:Not provably secure (Score:2)

      by UnknownSoldier ( 67820 ) on Tuesday November 01, 2011 @02:51PM (#37910664)

      Well, at least the OpenBSD guys admit on their _own_ homepage the last time they were vulnerable. What other OS manufacturer does that at _all_ ??

      I appreciate the honesty and public disclosure -- not trying to sweep it under the rug like almost every OS does.

    • Re:Not provably secure (Score:1)

      by optymizer ( 1944916 ) on Tuesday November 01, 2011 @03:27PM (#37911072)
      Since Halloween was yesterday:

      Kriston, if there are no candies at the store, the store has no candies for sale. That's not to say there couldn't be any candies left in a drawer by accident, but, no one knows if they exist, hence the above still holds true: the store has no candies for sale. There is no need for an external audit, because, even if you found some candies in a drawer as a result of the audit, the store still had no candies for sale at the time when they claimed they didn't have candies for sale (unless the audit finds tons of candies not disclosed to the public, which is not the case here).

      Your argument about the community doesn't hold either. Here's a counter-example: I'm part of an extremely small group of people dealing with a specialized web application. There are only about 20 people in the world using it. I've found at least 10 critical security holes in the default install, just by using it. I've patched about 20 minor bugs, and I'm just a user, I'm not on the developer/QA team. When a product has issues, the community (regardless of size) will still find a percentage of the total issues available. The fact that OpenBSD had 3 issues found in the default install in a decade is impressive, especially since they have _way more_ than 20 users in the entire world AND OpenBSD, as a package, is enormous, with hundreds of utilities and dozens of services waiting to be exploited. But, where are the exploits? That's right.

      So, in that context, it's a hell of a lot more secure than other OSes. q.e.d.

    • Re:Not provably secure (Score:2)

      by epine ( 68316 ) on Tuesday November 01, 2011 @06:56PM (#37913814)

      Please prove this wrong.

      Why? So that you can stand there raising and lowering the bar with your brain on dial-tone while everyone else does the heavy lifting?

      I'm sure it costs tens of millions of dollars to prove that any system is secure, and the proof won't even be correct. Does OpenBSD say "provably secure" on its web site? I didn't think so.

      You want proof? You can't afford the proof!

      In the real world, this is actually a matter of judgement and prudence. Your assertion that no-one tries to attack OpenBSD falls under [citation needed].

      OpenSSH for certain is among the juiciest targets out there for a zero-day. If portable SSH falls, you can bet that the native OpenBSD SSH would be scoured for the same vulnerability. There's no reason to regard OpenBSD itself is any less secure than OpenSSH on public information about how the project operates. While other projects are busy adding features, OpenBSD is busy adding chroot jails and stack guards.

      I will concede that in many ways it's legendary host-based security matters a lot less than it once did, because the attack vectors on what people care about (credentials) are mostly application specific.

      No one secures the social network.

      That's the number one sad-sack reason why OpenBSD is fading in relevance. Technical arguments have nothing to do with it.

    • HAH! youare ignorant of IT security industry (Score:2)

      by iggymanz ( 596061 ) on Wednesday November 02, 2011 @12:22AM (#37916124)

      Then why does the OpenBSD team have recognized leadership in the security industry, their wares are part of major OS such as HP/UX, Sun Solaris, sgi IRIX, and in products such as certain models of Cisco and Juniper routers and HP Procurve switches?

    • Re:Not provably secure (Score:2)

      by Chrisq ( 894406 ) on Wednesday November 02, 2011 @05:06AM (#37917374)

      Please prove this wrong.

      Right, just after you prove that there isn't an invisible pink unicorn sitting on my monitor.

  • Not had a good experience (Score:1)

    by Staticharge ( 2497386 ) on Tuesday November 01, 2011 @02:28PM (#37910400)

    I keep wanting to try one of the BSDs out on a preliminary basis to see how it compares to Linux, but honestly every one of them has irked me from the point of installation. I've tried FreeBSD, OpenBSD, and PC-BSD.

    The former two were somewhat cryptic to me, despite 10 years of Linux experience. I've done everything from manage servers to develop for embedded systems, and I always managed to figure things out. But FreeBSD, for example, gives me this somewhat counter-intuitive menu to go through, most of which I figured out, despite my lack of understanding of BSD partition types and all that. The problem though came from the packages. If you don't do anything, it just defaults to a console installation. And that's fine for some situations, sure. But actually trying to install the GUI was another story. I felt like a complete idiot trying to figure out their menus. It wasn't smart enough to just realize that the packages it might need aren't on the basic install CD, so initially I couldn't even find Gnome to install it. Immediately I was turned off by this seemingly primitive package system. But even when you get into the menu to select an internet source, it's a huge mess. I tried to pick Gnome, but it seemed that no matter what I did, I ended up with a plain CLI installation without even basic X. I had no idea where I was going wrong. I tried sysinstall afterward, read some stuff online, but I could not make the damn thing work. So I ended up trying to do it from the command line instead, which in fact was a million times more straightforward than their interface. But without knowing what all packages I actually needed for a full install without digging around, and upon realizing I still would have to manually edit my config files to make X launch with Gnome and all, I just threw my hands up and said forget that mess. If I wanted to go to that much trouble just to try something out, I'd install Arch or Gentoo or something. It's also worth pointing out that pkg_add is a very ugly tool, and not nearly as informative of progress as, say, APT. Perhaps I'm spoiled from all of my Linux use, though.

    PC-BSD is supposed to be the most friendly, yet not only did it contradict itself in how much space it would require between two different install attempts, but the first time it failed after the install began, and the second time it said it needed more space than I had allocated in the partitions (and that was both with auto-allocate as well as me doing it manually). Considering there's absolutely nothing different you can choose at that stage of the installation to affect disk space or anything (selecting basic stuff like keyboard type), I have honestly no idea why it was different on each attempt. The third time, when I gave up and just created a bigger virtual partition than I wanted to originally allow it, it then appeared to start downloading a single huge image rather than separate packages. I canceled it after realizing it would take a million years to get from their slow server.

    I heard that the release candidate for FreeBSD 9 had a friendlier installer, but a) it seemed pretty much the same text-based one to me, and b) none of the download mirrors in the installer would acknowledge the version I had and wouldn't let me download any packages.

    I'm sure many BSD veterans will simply think I'm a moron, am too impatient, or maybe I just had a string of bad luck. And maybe you're right on all counts! And sure, I could go read tutorials on how to do it "properly." But honestly, after using so many variations of Linux over the years, all the way back to the much more cryptic Red Hat installations of yesteryear, you'd think I would be able to figure out BSD no problem. Instead, I just gave it a big sigh, threw my hands up, and said forget it. I haven't needed it so far, so I probably won't need it anytime soon either.

    And yet the (stubborn) geek in me still wants to know if it's any better once it's actually up and running, because I know the kernel is supposed to be much cleaner and more optimized than Linux, so I doubt this will be my last attempt.

  • ZFS performance? (Score:2)

    by LWATCDR ( 28044 ) on Tuesday November 01, 2011 @05:41PM (#37912914) Homepage Journal

    Any benchmarks with ZFS yet?

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close