OpenBSD 8.0 Released (linuxiac.com) 42
OpenBSD 8.0 has been released with major virtualization and hardware upgrades, including support for up to 64 vCPUs per VM, Intel Arc graphics, ARM64 hibernation, and expanded RISC-V support. Linuxiac points out that it marks the "61st release of the security-focused Unix-like operating system." From the report: Several fixes improve compatibility with 32-bit Linux guests, while changes to virtual machine ownership management and interrupt emulation make the virtualization infrastructure more capable. Graphics support has also been upgraded, with DRM drivers updated to those from Linux kernel 6.18.53. Notably, OpenBSD 8.0 adds support for Intel Arc A-Series (Alchemist) graphics cards through the inteldrm driver.
Another important change increases the amd64 kernel's virtual address space from 4 GB to 512 GB, allowing the system to map over 4 GB of video memory. The release also addresses GPU timeout issues affecting some Intel Alder Lake systems. [...] For security, OpenBSD 8.0 adds checks and fixes across the kernel and system utilities, including improvements to pledge and unveil, tighter validation of executable files, and protections against memory corruption and information disclosure. A full list of changes can be found here.
Further reading: Wine Ported to OpenBSD
Another important change increases the amd64 kernel's virtual address space from 4 GB to 512 GB, allowing the system to map over 4 GB of video memory. The release also addresses GPU timeout issues affecting some Intel Alder Lake systems. [...] For security, OpenBSD 8.0 adds checks and fixes across the kernel and system utilities, including improvements to pledge and unveil, tighter validation of executable files, and protections against memory corruption and information disclosure. A full list of changes can be found here.
Further reading: Wine Ported to OpenBSD
wow (Score:3)
Another important change increases the amd64 kernel's virtual address space from 4 GB to 512 GB, allowing the system to map over 4 GB of video memory.
Wait, what year is it?
Re:wow (Score:5, Informative)
They didn't support SMP for a long time either.
OpenBSD tends to lag behind most OSes in "workstation quality of life" features, whereas they tend to be world-leading on unambiguous specs, and code correctness. (And man pages, IMO)
Their excellent security reputation is well deserved, and is downstream of their priorities... which I would describe as "skeptical of shiny new things with ambiguous semantics"
Re: (Score:1)
Their excellent security reputation
So is the PITA-factor. I ran OpenBSD for years but it was like pulling teeth and I'm glad I stopped.
Re: (Score:3)
It goes pretty smoothly until you try and deviate from their defaults. Change the partition layout and Theo gets angry. It got stupid a while back because their default size for /usr wasn’t big enough to fit the sources to build a kernel.
Re: wow (Score:4, Interesting)
For me the problem was they didn't support a NIC which was supported by Linux and they refused to add it based on the Linux driver even though it was already well settled by that time that they could copy constants from GPL sources without being poisoned by them. So I could do it myself or fuck off to Linux, and I chose the latter over their obstructionism.
Re: (Score:1)
Did you ever consider that you are an asshole? It is not anybody else, it is you that is a problem.
Re: wow (Score:1)
Did you ever consider that when a coward says shit like that they prove the opposite? If you had a real opinion you wouldn't be afraid to express it. My detractors are consistently the most pathetic douchebags.
Re: (Score:1)
Re: (Score:2)
They didn't support SMP for a long time either.
That alone kept the *BSDs out of my home lab for years.
Reminds me of the Red Hat glib pthreads debacle of the late 1990s.
Re: wow (Score:2)
but their concerns were ultimately proven correct, over and over.
there were significant LPEs in other OSes that were exploitable because of kernel lock bugs and race conditions.
and since the smp days, entire new classes of bug (eg info disclosure because of observable side effect bugs in cpus w parallel speculative execution) have also been invented as new processor architecture features have become common.
concurrency is still hard, 30 years later.
OpenBSD's main utility (Score:2)
This OS would be mainly used as a firewall/router OS, and so most suitable for "appliances" - routers, firewalls and the like. It's not likely to be one's gaming computer or where one goes to post to social media
Once one recognizes that, OpenBSD isn't what one would install on, say, a 32-core CPU. For such a thing, first put a hypervisor on, and then assign a certain number of CPUs to OpenBSD
The year of OpenBSD doing what it is designed for (Score:2)
Wait, what year is it?
The year of OpenBSD doing what it is designed for, really really well, yet again.
Re: (Score:2)
Precisely! It's a great firewall OS, and one can even toss in routing, multihoming and being a DHCP server for a switch. It's not the platform on which to play your latest Steam title - use SteamOS for that
Re: (Score:2)
It's a great firewall OS, and one can even toss in routing, multihoming and being a DHCP server for a switch.
And when you need a unix console it would also be a pretty handy box to ssh into as well.
Arguably the best available (Score:5, Informative)
It's not fancy, it's not trendy, it's sometimes a bit of a pain, but if you're serious about security, this is what you want to be running -- particularly on anything that has to face the public Internet. It's well worth the investment of time and effort.
Why switchh? (Score:4, Interesting)
I always ask "What might be some compelling features that would make me interested in switching to OpenBSD from another distro?"
So, what does OpenBSD offer that would be of benefit for users to switch over to it?
Re:Why switchh? (Score:4, Interesting)
So, what does OpenBSD offer that would be of benefit for users to switch over to it?
It starts out with a minimal amount of packages. You don't have a dozen half assed text editors or file managers. You add pieces as you need them. Plus the documentation is top notch and always up to date. How do you set an ip address in linux using the command line? Is it ifconfig, ip, connman, netplan, or whatever systemd cooked up this week.
It's how linux used to be in the 90s.
Re: Why switchh? (Score:5, Informative)
Try slackware linux. Non of that systemd trojan horse crap, just plain init, and a relatively sane amount of packages.
Re: Why switchh? (Score:4, Funny)
Where systemd may not be considered secure is it's certainly not minimalist. It has a lot of commands in that one package. But many of those commands exist to avoid dragging in even larger packages for the sake of using small bits of them (e.g. to set the time without ntpclient), but there have been flaws found over the years.
Re: Why switchh? (Score:2)
Systemd has fuck all to do with security. Everything you mention can be done on an init based system and cgroups was around for years before systemd was farted out of poetterings arse.
Re: (Score:2)
Re: Why switchh? (Score:2)
Doing security tasks that were already doable and done does not mean it has improved security. Next time buy a cluetrain ticket first before posting.
Re: (Score:3)
But does any sysvinit based dist do it? Devuan, the white knight of the dump-systemd "movement" certainly doesn't. Service sandboxing? Nope. Cgroup process tracking? Nope. Credential handling? Nope. Log tamper proofing with FSS? Nope - rsyslog has some tamper evident features but the capabilities are way easier to set up in systemd. Disk encryption via TPM? Nope. Le
Re: (Score:2)
An init system is not supposed to do security. This is something Poettering and you don't seem to get. Its perfectly possible to secure a system without systemd and just because you don't know how to do it doesn't mean it can't be done and wasn't done before the systemd dogs dinner was written. NOTHING you have mentioned should be done by init. I suggest you go look up the unix philosophy then get back to me. If you don't like it maybe you'd be better off with Windows.
Re: (Score:2)
Re: (Score:2)
"Erm, yes it is and yes it does. At least if you use systemd."
Way to go on completely missing the point.
"And you say "perfectly possible" and yet sysvinit and other systems don't do it."
FFS. Perfectly possible to do it outside the init daemon. sysvinit wasn't designed to and never will do any of that - it starts the system and other than respawning dead system processes it gets TF out of the way which is how it should be. If you don't understand why then stay away from unix. Like I said, it sounds like Wind
Re:Why switchh? (Score:5, Informative)
2. Security
3. Security
OpenBSD's maintainers are focused on security because they recognize that if you can't compute securely...you can't compute. They're (relatively) quick to remove code, (relatively) slow to add code, because -- as we've learned -- this is just about always the path to improved security.
4. Simplicity. The base OpenBSD install is small and runs efficiently on minimal hardware: I have a test system that's over 20 years old and it just hums along with each new version. Of course you can add any of thousands of packages, but they're not cluttering up everything by default. Note that this minimal install is also aligned with security: "ps" on base install doesn't show much running and 'netstat -a" doesn't show much listening. Contrast with many contemporary Linux distributions that install and run all kinds of things by default.
5. Firewall. OpenBSD's "pf" is the best firewall available, period. it's easy to configure (uses text files), easy to maintain, runs well with minimal CPU and memory, and in almost all cases, is only bandwidth-limited by the speed of the network interfaces.
6. Robustness. OpenBSD continues to stay functional in situations that would lock up or just crash other distributions. A few months ago, one of my systems was hit with a novel DoS attack that pushed the load average over 40; that system was still responsive at the command line and I was able to squelch the attack...and then everything just went back to normal. No reboot necessary. Of course that's how everything should work but it's not how most things really work.
7. Stability. While of course there are occasionally flag days on which old things stop working, for the most part, OpenBSD is very stable. Code that you compiled and ran on OpenBSD 5.7 is highly likely to compile and run on OpenBSD 8.0. Yes, there are scattered exceptions to this -- but worth noting is that some of those aren't the fault of OpenBSD, they're the fault of bad code.
8. FAST response to security issues. If something turns up, OpenBSD developers drop everything and deal with it. Fixes show up quickly, even to obscure bugs that are difficult to exploit or for which there is no known exploit.
The closest thing to OpenBSD in the Linux world is Slackware (and I run it on a few systems). But as good as it is...it's not OpenBSD.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
It was only when security was taken more seriously that dists started being more selective about what they installed. Most modern dists still have a couple of ports open, mostly locahost only but won't even run SSH unless somebody explicitly chose to install it. There are cut down Linux dists like Alpine whi
Re: (Score:2)
"It starts out with a minimal amount of packages."
So the advantage is that it doesn't install as much junk as other distros? That's good, but not a compelling reason to switch (for me personally). I see security mentioned a lot, and if I'd had any issues that would be a consideration.
Re: (Score:2)
Right. Only switch to it if you're running it on an appliance, such as a router or firewall. You can convert that router into multiple things - multihoming, firewall, routing, DHCP services
Re:Why switchh? (Score:4, Informative)
This question comes up on every release :)
See: https://www.openbsd.org/securi... [openbsd.org]
Many of these were also added to other Operating Systems after they were added to OpenBSD.
Re: (Score:2)
Does your answer translate to "It's more secure"?
Re: (Score:2, Interesting)
Re: (Score:1)
I always ask "What might be some compelling features that would make me interested in switching to OpenBSD from another distro?"
So, what does OpenBSD offer that would be of benefit for users to switch over to it?
When staying alive is your #1 priority, you tend to not give a shit what color shirt or brand of shoes your bodyguard is wearing. The only "feature" you're looking for, is the only one you asked for; Security.
From a target standpoint, it's the GenX of OSes. It can be a pain and cover your ass, all at once.
Welcome to the Open Side. I'd offer you cookies, but you took the default setting and put the whole damn kitchen behind the firewall..
Re: (Score:2)
I'm not asking about shoes or shirts.
Again, what does OpenBSD offer that would be of benefit for users to switch over to it?
Why should I consider switching to it as opposed to some other distro?
(You're usually pretty helpful but this answer did not bring any clarity.)
Re: (Score:2)
As I noted above, it's the perfect firewall OS, and so you can have that on an appliance. If you get an OpenBSD VM, you can configure it not just as a firewall, but also add multihoming, routing and DHCP services to it. Then feed it to a switch or a WAP, and distribute that secured internet to all the nodes within your network. Only thing that I'd switch from is OpenWRT or OPNsense or pFsense or RouterOS, not from something like Cachy Linux or MidnightBSD or Windows or macOS
If you are playing Steam gam
Routing & load balancing (Score:2)
A couple of questions:
1. Does eigrpd now do a better job supporting IPv6 as a routing protocol?
2. How is its load balancing capabilities?