Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems BSD

OpenBSD 3.5 Reviewed 81

Posted by CowboyNeal from the products-of-canada dept.
eeg3 writes "NewsForge has a review of OpenBSD 3.5. It encompasses a fair amount of information, more specifically it details security, cryptography, installation, and new features." While not afraid to point out OpenBSD's shortcomings as a desktop OS, it's still a good tour of possibly the most secure OS. NewsForge and Slashdot are both owned by OSDN.
This discussion has been archived. No new comments can be posted.

OpenBSD 3.5 Reviewed More

OpenBSD 3.5 Reviewed

Comments Filter:

  • Question (Score:5, Interesting)

    by NanoGator ( 522640 ) on Thursday July 22, 2004 @10:36PM (#9776188) Homepage Journal
    Every time there's a story about a vulnerability in something Microsoft related, there's a ton of modded up comments to the tune of "people should use Linux and related stuff to be more secure." But if security's such a BFD, why isn't BSD more popular around here?

    • Re:Question (Score:3, Interesting)

      by black mariah ( 654971 )
      Because you can't like BSD and spooge all over the GPL at the same time.
      • Watch while this OpenBSD discussion somehow turns into a Windows vs. Linux flame war.

        I was at least hoping for some intelligent flames from FreeBSD people instead.

        --
        Healthy Info [health-issue-books.com]

    • Re:Question (Score:4, Insightful)

      by Nasarius ( 593729 ) on Thursday July 22, 2004 @10:50PM (#9776278)
      Linux is totally appropriate for a secure desktop system. OpenBSD is for insanely secure servers. The BSDs tend to lack the hardware support of Linux too and other things that just make Linux nicer for desktops.

      • Re:Question (Score:3, Insightful)

        by NanoGator ( 522640 )
        "Linux is totally appropriate for a secure desktop system."

        Well I don't know how to write this so it doesn't sound trollish. For that, I apologize in advance.

        Is what you're saying that a little less security is okay if it's more usable? If so, why isn't Windows given a little more credit?

        • Re:Question (Score:3, Insightful)

          by Nasarius ( 593729 )
          Windows isn't given more credit because it's crap. To put it in perspective, if Windows is a 1 in terms of security, Linux is a 10 and OpenBSD is a 12.
          See dh003i's post.

          • Re:Question (Score:5, Insightful)

            by Anonvmous Coward ( 589068 ) on Friday July 23, 2004 @12:24AM (#9776789)
            "Windows isn't given more credit because it's crap. To put it in perspective, if Windows is a 1 in terms of security, Linux is a 10 and OpenBSD is a 12.
            "

            A lot of Linux users out there are kidding themselves. Arugably, Linux is more secure than Windows. However, most of the Windows vulnerabilities we've seen lately were actually vulnerabilitys on apps running on top of Windows, i.e. I.E.. (Yes, I know it's part of the OS, but that's not to say that Mozilla or Opera couldn't have been developed to be dangerous. Hence the 'more' in my secure commment earlier.) Install and run an insecure app on Linux, then you're just about as vulnerable to outside attack. Not as vulnerable given Linux's excellent permissions system, but it's still more than enough to do damage.

            My point is not to say that Windows should be held in a better light, but rather to say that more secure is not secure. You still have to install updates, you still have to watch what you run on it, and you still need to back up/protect your data. If you're already doing that, then usability is of greater interest, and for a lot of people, Linux still has catching up to do.

            Ng's got a point. The security reason for people to switch to Microsoft is not the 1 vs. 10 reason it's made out to be here. (at least when talking about personal use, I wouldn't say the same if we were talking about deploying corporate workstations.)

            • Re:Question (Score:2, Insightful)

              by curious.corn ( 167387 )
              UNIX security model is much more easy to grasp and implement than whatever MS kludged together in the various pro versions of their environment. There's no such thing as chroot/jail in windows isn't it? I'm perfectly aware that an XP registry is rife with cryptic and mulply overridden account policy keys that only a specialized enterprise admin might make something out of it (that's probably why SPs often FSCK up deployed servers...). When a security hole exposes a 'nobody' or 'www' jailed server I can patc

              • Re:Question (Score:2, Insightful)

                by Anonymous Coward
                Yes, you can have a very simplistic deployment that uses a Jail to serve pron pics, and Linux/BSD works very well at that.

                However, in enterprise deployments, the "byzantine security model" blows away the Unix equivalents, in terms of pure, needed, functionality.

                We're talking about a crowd that still uses NFS, which hasn't even the concept of passwords! It's like super-intelligent space aliens attempting to communicate with cavemen. No wonder they can't understand and think their "Good-um Head-Smash Bone"
                • If you're talking workgroup management I agree with you. NFS isn't a viable solution and until recently cifs:// was pretty difficult to implement correcly. Mind you, it works splendidly on an ldap backend, and supports mutual certificate authentication (on server AND on client)... What I was talking about isn't pr0n servers you little flamebait smuck but enterprise web frontends... (and BTW, I've yet to see a properly and reliably funcional corporate desktop installation...)

              • Re:Question (Score:3, Informative)

                by Foolhardy ( 664051 )

                UNIX security model is much more easy to grasp and implement than whatever MS kludged together in the various pro versions of their environment.

                I don't find the NT security model to be hard to understand; what don't you understand? It hasn't changed much since the first version.

                There's no such thing as chroot/jail in windows isn't it?

                Yes, they are called sessions. Each session has a set of symbolic links in the Object Manager [sysinternals.com] that connect devices to a session's namespace. The Object Manager is like Linux's

                • Fine, I'm not an expert NT admin but the link you provided on object manager somehow proves my point. The linked page begins by enumerating the bugs of the system provider interface to such a crucial security feature. Now, let's not fool ourself, enforcing chroot and namespace isolation isn't rocket science. Trouble is, MS just provides a useless and buggy handle for it and this I find unacceptable. They claim to provide low TCO but I'm still required to google around the damn web for some freeware (oh the

        • Re:Question (Score:5, Informative)

          by Creepy Crawler ( 680178 ) on Friday July 23, 2004 @12:03AM (#9776685)
          ---Is what you're saying that a little less security is okay if it's more usable? If so, why isn't Windows given a little more credit?

          Hmmmm, interesting question. Let me present you problems that Ive not found Windows to handle.

          1: Allowing graphical interface but NOT allowing 3D graphic card operations used (Simple with X, deny access to DRI)

          2: Allowing programs from remote TRUSTED computers to have their graphical output displayed locally. (X was made for this exact purpose)

          3: Making user accounts with almost no permission to the local computer (remote mounted directory trees)

          4: The ability of an extremly fine grained system security model (NSA patches, now in the 2.6 kernel)

          5: Being able to fix terminal (as in bad) errors within your servers woithout having to rely on external help (Domain Admin accts either locked out or scrambled in Win2k3- no known way to harvest other than full reinstall)

          6: Does not need a desktop environment to run. Just instead open the Xserver and have onload the program needed for work.

          7: Can be done on a Xterminal or bare-bones PC with network connection. I know of no Windows OS that this can be said for.

          Im sure there's more... but Oh well ;)
          • 1: Allowing graphical interface but NOT allowing 3D graphic card operations used (Simple with X, deny access to DRI)
            Could you explain why you would like to do this? I mean what security gain you get by doing this? I cannot imagine a scenario were a person should be allowed use of the display, but should not use high-speed 3D operations, or where using those operations would be damageable to the system.
          • 1. Move the video acceleration level to zero. (Display->Settings->Advanced->Troubleshoo t) This will implicitly disable direct draw and direct3d.
            Or, use dxdiag.exe to disable them more directly. Only local admins can change those settings.

            2. Connecting to a single window remotely isn't natively supported but Citrix supports it. There is some kind of deal between MS and Citrix to prevent MS from including it standard.
            Oh and what happens when the X server dies unexpectedly, takes your server (X cli

      • Re:Question (Score:5, Informative)

        by Anonymous Coward on Friday July 23, 2004 @12:18AM (#9776754)
        "The BSDs tend to lack the hardware support of Linux too and other things that just make Linux
        nicer for desktops."

        Let me think of how to put this in a nice way...

        BZZZZZZZZT! Try again. BSD usually the hardware before Linux has it, off the top of my head I can think of USB2 and FireWire.

        Happy trolling!
        • It's not that simple, a lot of my hardware at some point wasn't supported by {Free,Open}BSD but was by Linux, such as the Hauppauge WinTV PVR350 TV capture card (right now), Aureal Vortex 2 sound card, OnStream DI30 tape streamer, VIA Nehemiah's CPU frequency scaling.

          Because of that I switched my server/MythTV box to Linux, though I was perfectly happy with FreeBSD on my server before it had to run MythTV on a PVR350.
        • Comment removed based on user account deletion
    • Because BSD is dead, obviously.

      It might have something to do with the fact that security isn't actually worth being secure unless you have to do it yourself, and as such, with most BSDs being rather secure out-of-the-box, doing it that way is a pussy way out. </SARCASM>

    • different solutions for different problems (Score:5, Insightful)

      by dh003i ( 203189 ) <dh003i@@@gmail...com> on Thursday July 22, 2004 @11:23PM (#9776459) Homepage Journal
      If you are running a server, and security is extremely important, there is nothing better than OpenBSD. Period, end of discussion. Banks and financial institutions should not be using Windows, Linux, or even FreeBSD servers: they should be using OpenBSD servers. Likewise for any website online trafficking in sensitive financial information and private information.

      For websites that don't deal in such sensitive information, OS' that are less secure are acceptable, such as FreeBSD and various Linux' suitable for servers (Slackware, Debian, Gentoo).

      For Desktop users, security isn't as paramount. However, it is still important, especially if you store any sensitive information on your computer. Some people store their private financial information on their computers. This is why Windows creates problems. Other Windows security problems are just obvious: the plethora of virus', exploits, worms, etc etc etc. These are areas where Linux is better (if not misconfigured so as to be insecure). The reason for Linux and not OpenBSD is because computer's are not an end in themselves. They exist to do certain functions; many of the daily things which people want to do on their computers just aren't possible to do on OpenBSD, or are a real pain, but are possible to do in Linux.

      Stating people should use Windows, MacOS, Linux, or xBSD is over-general. Do you know precisely what every users' needs/desires are? No. Then how can you possibly say what OS they should use? The answer is you can't.

      Of course, I haven't really responded to your question "if security's such a BFD, why isn't BSD more popular around here?" The answer is that security isn't considered paramount, above all else. If you wanted to be completely secure with your computer, you could unplug it from the internet and never plug it back in, and lock it up in a vault-room, with finger-print protection. People here probably consider other things important as well...

    • Re:Question (Score:2, Interesting)

      by Anonymous Coward
      > But if security's such a BFD, why isn't BSD more
      > popular around here?

      Because for many (most?) in the Linux community
      it's not about correctness or quality of the OS,
      it's about licensing (GPL), bringing down the evil
      empire (Microsoft), and revolution (down with Cap-
      italism).

  • It's not true that OpenBSD does not support network installation of packages with automatic dependency handling.

    Try this (assuming a Bourne-style shell):

    PKG_PATH=ftp://ftp.openbsd.org/pub/OpenBSD/3.5/pac kages/i386/
    export PKG_PATH
    pkg_add p5-DBD-mysql-2.90.03

    All dependencies are discovered, downloaded, and installed as necessary. The only real downside is that you need to know the version of the package.

    Check pkg_add(1) for the details.

    • True, but all the BSDs and for that matter Linux urgently need a package management system that works, and what is more can be made to work over a modem link with 2 hour time limit. Neither Xandros nor SuSE have had the decency to respond to bug reports about this from a paying customer, it is not possible in Fedora either (some packages like the kernel tend to be upwards of 130MB), and while most of the world still has to use modems, security patches can simply not be applied.

      Time for a well thought out sy

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (10) Sorry, but that's too useful.

Close