Hacker News Reader

Comment by zdw | Hacker News Reader

I've been deploying OpenBSD in production since the 2.x days (late 90's, an example machine was a recycled 486 with a PCI and ISA 10Mbit/s ethernet cards).

While it's possible to use OpenBSD as a general purpose server or desktop, that's not where it's strength lies.

It tends to excel as a firewall or router for the under 1Gbit/s crowd that has Unix sysadmin experience - basically, appliance applications where it would function in the same role as a Cisco or Juniper router device.

OpenBSD's leadership has a goal of pushing the security envelope, and force positive change on the rest of the Unix ecosystem, which it's succeeded in doing in many ways.

View on HN

OpenBSD's leadership focuses on clean and correct code, not necessarily on security. Of course, that leads to security though.

This is incorrect. Security is definitely a first-class goal for them, not "just" clean and correct code.

That is, they do not only fix code, but try hard to ensure that code which doesn't match their quality goals can't do much harm. And this is security.

The topic at hand (vmm) is the best example for that. At a first glance, this is about creating a clean and correct hypervisor. But what is this good for? To be able to run less secure systems within OpenBSD without them doing too much damage.

Another example is pushing hard to enforce W^X on all kinds of applications, even browsers:

http://www.tedunangst.com/flak/post/now-or-never-exec

This doesn't fix any existing bugs, but it actively mitigates the damage that a bug may have (ideally, it prevents a buffer overflow bug from being actually exploitable).

From their website:

http://www.openbsd.org/security.html

| Our aspiration is to be NUMBER ONE in the industry for security

Sure, security by clean and correct code is their main measure to increase security. They call it "proactive security". But there's tons of stuff in OpenBSD which is "merely" mitigation.

> This is incorrect. Security is definitely a first-class goal for them, not "just" clean and correct code.

I get the impression that the dominant attitude among OpenBSD developers is that if you have to choose between simplicity and security, your basic approach is flawed and should be reconsider. This line of thinking - that you don't make things more secure by making them more complicated - also results in a simple yet powerful system.

So unless I am mistaken, "clean and correct code" and "security" are not two different goals, in a way they are two faces of the same coin.

I've used it as my main work desktop for years.

What web browser are you running, and what's its security story?

Chrome and Firefox. I also play with Xombrero (based on Webkit), but though I like it a lot from a feature standpoint, it's the least stable of the three.

None are as stable as their Linux or Windows counterparts.

What problem does pf have after 1Gbit/s?

Back in the day, it was the limitations of PF under SMP. I don't think that's been an issue for a few years now, though.

You don't need SMP for much work up to 10Gb/s on modern hardware. Not sure if OpenBSD has 10Gb driver support or not (although FreeBSD and NetBSD do).

Of course OpenBSD has 10GbE.

But which? Mellanox, Intel, Solarflare, QLogic?

http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/...

I have no idea which driver names are 10gbit and I certainly don't go to a store and ask for hardware by its device ID or chip family name.

Perhaps if you actually read the driver description, or who knows, searched the web page you would have found the answer to your question.

Come on, amigo. Click the link, Ctrl-F for "10Gb", then click the links. The man pages even include the actual manufacturer part number that they've tested. What more could you need?

You don't today but back in 2007, we did. We we running 600-700 Mbps through a fairly complex PF ruleset on a Sun x86 server with Intel NICs on OpenBSD 3.9 and we were beginning to run up against a CPU wall. I'm sure things are significantly better today with modern NICs and 5.8.

pf itself, doesn't. depending on your CPU you can go far and above 1Gbps even with the tiniest of packets.

Apparently not many now, I haven't had the opportunity to test it with >1Gbit/s equipment. But for people who need network filtering at those bandwidths, usually there are other solutions that perform better on equal hardware.

This should get better soon as there's a lot of work being done in OpenBSD to make at least some parts of the network stack SMP capable.

Reply on news.ycombinator.com