Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
BSD

Interview: Ask Theo de Raadt What You Will 290

Posted by samzenpus from the go-ahead-and-ask dept.
Theo de Raadt was a founding member of NetBSD, and is the founder and leader of the OpenSSH and OpenBSD projects. He is currently working on OpenBSD 5.5 which would be the projects 35th release on CDROM. Even though he'd rather be hiking in the mountains or climbing rocks in his free time, Theo has agreed to answer any question you may have. As usual, ask as many as you'd like, but please, one question per post.
This discussion has been archived. No new comments can be posted.

Interview: Ask Theo de Raadt What You Will More

Interview: Ask Theo de Raadt What You Will

Comments Filter:

  • NSA (Score:3, Interesting)

    by Anonymous Coward on Wednesday March 05, 2014 @11:24AM (#46409079)

    Has the NSA scandal changed the status of the OpenBSD project?

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      Or rather
      What effect has the revelations from Snowden on the presence of active monitoring of communication in the US had on creating user demand for more secure systems?

    • Has the NSA scandal changed the status of the OpenBSD project?

      posting to undo bad mod, but also interested what effects Snowden leaks specifically the revelations of backdoored hardware and bugged hardware have had on OpenBSD, Is there anything that can be done in software for untrusted hardware?

  • NSA Involvement (Score:5, Interesting)

    by jazman_777 ( 44742 ) on Wednesday March 05, 2014 @11:25AM (#46409105) Homepage
    Given the pervasive nature of NSA compromising, do you know of any attempts by the NSA to put in backdoors or otherwise compromise OpenBSD--either by approaching you directly, or by infiltration?

  • Would you ever retire? (Score:3)

    by allaunjsilverfox2 ( 882195 ) on Wednesday March 05, 2014 @11:34AM (#46409221) Homepage Journal
    If so, How do you think the community would react / correct the situation?
  • Looking at a success of OpenSSL project in the private sector, key to this success is a very robust certification (FIPS and so on) effort. Are there any similar plans to dedicate resources to get OpenBSD endorse/certified?

  • Sparc64 and Oracle (Score:5, Interesting)

    by kthreadd ( 1558445 ) on Wednesday March 05, 2014 @11:38AM (#46409273)

    I recently needed a free software operating system that could replace Solaris on a couple of Sun UltraSparc machines. After testing out the relatively small number of alternatives I found that OpenBSD had by far much better hardware support than the others. I know that a lot of this is the result from the effort your group spent a couple of years ago to get docoumentation from what used to be Sun. How would you describe collaboration with Oracle now when they run the remains of Sun, in particular around supporting modern Sparc64 based systems?

  • updated OpenBSD rack picture? (Score:3)

    by rubycodez ( 864176 ) on Wednesday March 05, 2014 @11:40AM (#46409299)

    the rack picture on the lower right corner of the www.openbsd.org was taken in 2009. since architectures retired and some added since then, could we have a new circa 2014 picture?

  • Smoother Chroot and Sftponly integ into OpenSSH? (Score:4, Interesting)

    by See Attached ( 1269764 ) on Wednesday March 05, 2014 @11:40AM (#46409303)
    Very often we admins have to make all kinds of hacks to get OpenSSH to support Chroot and ScpOnly. Would it be possible to make it simpler for these features to be added/configured without third party tools? OpenSSH is a foundational package, and making it easier to add these features would make it all that much better. Would be great to stick to your source 100%!! Thanks for your many contributions!

    • Re:Smoother Chroot and Sftponly integ into OpenSSH (Score:5, Informative)

      by carlhaagen ( 1021273 ) on Wednesday March 05, 2014 @12:45PM (#46410129)
      There is no need for third-party tools for what you want to achieve. While the solution is a bit ungainly, all of it is already supported by OpenSSH and its sftp subsystem. This is how I configured things on my system:

      First off, add a group that you call f.e. "sftponly". New users that are to be allowed only sftp access should have "sftponly" as their login group, and have /sbin/nologin as shell to deny them shell access. Their home directories should be owned by root:sftponly, and within the home dir you then create relevant user-controllable directories which should be owned by :sftponly.

      Secondly, the sshd_config magic that makes the whole charade work:

      Subsystem sftp /usr/libexec/sftp-server
      Match Group sftponly
      ForceCommand internal-sftp
      ChrootDirectory %h
      • Small explanation: what happens is that when the SSHd matches the user's login group successfully, it forcefully switches over to the internal sftp component instead of the default external subsystem, which in turn makes it possible to chroot the user to his/her home dir without having to place a plethora of system files in each user's home directory.

  • Raspberry Pi-class hardware - BeagleBone Black? (Score:5, Interesting)

    by emil ( 695 ) on Wednesday March 05, 2014 @11:43AM (#46409335)

    I would like to run OpenBSD on the Raspberry Pi.

    I understand, sympathize, and accept your decision to avoid that platform, but what would you recommend as a stable substitute?

    The BeagleBone Black seems like the endorsed alternative, although there were stability warnings until recently. The current status reads: "There are generally still a fair number of things to do on each of these boards, however OpenBSD is generally considered to be usuable on them. The platform is now self hosting, however there is no SMP support."

    Would you point OpenBSD users interested in this hardware class at the BeagleBone Black? Any other advice? SLC media preference?

    TI has announced that it is discontinuing the OMAP line. Will Beagle move to another ARM licensee, and does that matter much for OpenBSD?

  • Trying too hard (Score:2, Insightful)

    by nmb3000 ( 741169 )

    Slashdot interviews for Richard Stallman, Eric Raymond, and now Theo, all in the last week?

    What happened? Did someone at Dice push Slashdot management to try and "reclaim technical roots"? Is someone a little worried about http://soylentnews.org/ [soylentnews.org]? Or maybe this is part of a last-ditch effort to increase revenue^W^W reclaim reader loyalty?

    Slashdot Media was acquired to provide content and services that are important to technology professionals in their everyday work lives and to leverage that reach into the global technology community benefiting user engagement on the Dice.com site. The expected benefits have started to be realized at Dice.com. However, advertising revenue has declined over the past year and there is no improvement expected in the future financial performance of Slashdot Media's underlying advertising business. Therefore, $7.2 million of intangible assets and $6.3 million of goodwill related to Slashdot Media were reduced to zero.

    source [diceholdingsinc.com].

    Perhaps not, but really, you guys are still trying way too hard now. I'd have thought you realized by now that successfully running a site like this is a marat

    • When I looked at Soylent News this morning, there were 5 or so stories with less than 5 comments, and the quality of some of the last few submissions has actually been worse than what we typically see here. I'd like SN to succeed and viable competition should force Slashdot to improve, but it's going to take some real effort.

      • Re: (Score:3)

        by Anrego ( 830717 ) *

        Yeah, soylentnews seems to be fizzling.

        It's a shame really, but I suspect it won't be the last "bring back old slashdot" effort. Eventually someone will get it right / get enough momentum to keep going. It might happen if slashdot ever actually switches everyone to beta.

    • Yes try too hard!! (Score:4, Funny)

      by rubycodez ( 864176 ) on Wednesday March 05, 2014 @12:30PM (#46409959)

      I applaud efforts to make slashdot more technically relevant and useful and interesting, keep trying too hard!

    • Slashdot interviews for Richard Stallman, Eric Raymond, and now Theo, all in the last week?

      I only hope we get the answers to all of them. If you watch carefully, every now and then there seems to be a Q&A session here with no answers ever posted!

  • Finances and technologies (Score:4, Interesting)

    by Noryungi ( 70322 ) on Wednesday March 05, 2014 @11:46AM (#46409387) Homepage Journal

    OK, tongue-in-cheek question: did you cash in all those bitcoins before Mt Gox imploded?

    More seriously: what are your thoughts on the future of ZFS, BHyve, non big-lock SMP, SMP-enabled pf (see NetBSD npf) on OpenBSD?

    Related question: what is the future of OpenSSH-based VPN functions?

    Even more seriously: in light of the recent Snowden revelations on NSA spying, can you tell us more about the audits realized after a few (past) developers were accused of creating backdoors in OpenBSD for the FBI?

    Finally, and this is not a question: all my thanks for a great OS. I use it daily and truly appreciate all the hard work.

    • What part of "As usual, ask as many as you'd like, but please, one question per post." don't you understand?

      • Re: (Score:2)

        by rev0lt ( 1950662 )
        I can take one of his questions :D They are all quite relevant and interesting, but I'd add HammerFS to the list also, since its one of the projects listed in Google SoC.

  • What's your average day like? (Score:5, Interesting)

    by ModernGeek ( 601932 ) on Wednesday March 05, 2014 @11:46AM (#46409389)
    Last time I saw pictures, you and others were working from a home. How is everything structured now? Are you living alone and working from your house, or are there others there, too? How has this affected you long term with your personal life and relationships? What type of job did you have before OpenBSD? Assuming you did before, do you ever miss working in an office?

  • signed code (Score:4, Interesting)

    by smash ( 1351 ) on Wednesday March 05, 2014 @11:49AM (#46409437) Homepage Journal

    What are your thoughts on code signing, and do how do you see the development of such proceeding in the free unix world. In Powershell for example, i can set a system-wide policy to only run scripts if they are signed with a trusted certificate.

    This means I can, for example, delegate script development to an underling, review the script and then sign and push into production, knowing that the script will not run if it has been modified in the field without authorization - enabling proper change management process to be enforced.

    Other platforms require all code to be signed before it will run.

    Do you foresee anything like this (obviously with the master signing authority being the local site admin) for OpenBSD?

  • I know it can sometimes be more of a burden, but thanks for all the work you have done Theo. I use OpenSSH everyday, and I find it to be one of the most reliable, most secure (even with all the NSA revelations) pieces of software in daily use around the world.

    That being said, the more I investigate how to increase security, I am increasingly struck by how borked SSL is as a whole. (CA messes, vulnerable to MITM, DPI, etc).

    My question is this: do you think at some point we should start re-evaluating our fund

  • Comment removed based on user account deletion

  • I appreciate the fundamental work that OpenBSD does in security and other areas, especially things like the recent work in getting X to run without privileges.

    AFAIK OpenBSD was the first to accomplish this, and I'm wondering how much of that research and know-how, maybe not code, can be used by other *NIXes? I know there are license conficts between the BSD's and Linux, but how much of the experience gained from that effort can be used to improve other *NIXes even if code cannot be reused? Is the OpenBSD

  • Are there any efforts made to ensure that OpenBSD can run native apps written for other platforms, such as Linux or FreeBSD? Or is OpenBSD's target usage exclusively routers & firewalls?

  • What other platforms? (Score:4, Interesting)

    by unixisc ( 2429386 ) on Wednesday March 05, 2014 @12:02PM (#46409611)
    Given that a lot of the platforms that OpenBSD was ported to are now dead - such as PowerMacs, Alphas, PA-RISC and so on, are there any efforts on to port OpenBSD to non-x64 platforms that exist today?

    • there is dead in the sense of "no longer sold", but if many people still use a platform and can have a modern current OS running, is it really dead?

      • Yes & no. It's not dead until it croaks, but once it does, it is unlikely to be replaceable - unless one finds another old box on eBay. OTOH, when it croaks, since it's FOSS, people can move it to another box, such as the Itanic (LOL) and continue work there.

    • Those platforms still help finding new undiscovered bugs. That's one of the points in continuing support for those.

  • If you couldn't use OpenBSD anymore what other OS would you prefer to work with?

  • I read a message thread on a Linux board which presented the idea that using strlcpy, instead of strcpy, was a crutch that encouraged sloppy coding because the programmer will no longer think about buffer sizes.

    .
    I know you are a proponent of strlcpy. Why do you think some projects resist using it so much?

  • OpenBSD and Wi-Fi (Score:3)

    by carlhaagen ( 1021273 ) on Wednesday March 05, 2014 @12:23PM (#46409895)
    I've been using OpenBSD as my wireless home router, server and development platform since 2005, and can from 9 years of experience safely say that the current state of OpenBSD's Wi-Fi drivers and 802.11 stack is troubling. On one hand, most chipsets out there have rudimentary driver support in OpenBSD, including WPA2 and CCMP facilities. On the other hand, the 802.11 stack still lacks 11n support (minor problem) but what's much worse is that while only two of the drivers - ral(4) and athn(4) - state that they can handle power-saving clients when running in HostAP mode, none of them actually do it properly. None of the support ral(4) chipsets can handle power-saving clients despite what the ral(4) man page claims, and while athn(4) works slightly better it's still flaky with unreliable results, no matter what wireless chipset the client uses. The effect is that OpenBSD is useless as a wireless access point without having the clients pull one of several tricks available to avoid them from entering power-saving mode, as have been posted and explained by troubled users on the OBSD mailing lists regularly over the years.

    I understand that Wi-Fi portions of OpenBSD aren't exactly prioritized, but are these issues even on the roadmap?

  • What does OpenBSD/OpenSSL/etc. need? (Score:3, Interesting)

    by tearmeapart ( 674637 ) on Wednesday March 05, 2014 @12:23PM (#46409899) Homepage Journal

    In your opinion, what does OpenBSD/OpenSSL/etc. need from the community?
    Now that you received a large donation to keep the lights on, what is next on the list of things that would help move things forward?

  • I know there is systrace, but that really isn't what I am looking for. Will there be plans to have a proper auditing daemon be able to monitor system calls in a log file? Being security centric, I would think this would be something high on the list. I know it puts a lot more load on the system and may be difficult for smaller systems, but auditd logs are considered good practice in Linux and FreeBSD. Any chance this will make it into OpenBSD at some point?

  • Was documentation a priority? (Score:3)

    by dubbreak ( 623656 ) on Wednesday March 05, 2014 @02:04PM (#46411213)
    If so, how did you make it a priority? More specifically, as the leader of OpenBSD what did you do to ensure great documentation?

    As a software developer I know that documentation often falls to the wayside (features take priority, schedule already tight etc). As a project manager it's difficult to get good documentation (staff does poor job, stakeholders don't want to pay for it etc). OpenBSD has really good documentation (in my opinion) and it was really useful when initially getting to know OpenBSD, PF etc. Most of the pay for middleware I use has documentation that is absolute shit (incomplete, wrong, not up to date etc). To me the state of documentation in OpenBSD is more impressive than "Only two remote holes in the default install, in a heck of a long time!". Of course, "You'll love our man pages!" doesn't have quite the same ring to it.

    • Documentation is more important than code. He insists on documentation first.

      I once watch him rip a developer a new one (and ripped out code) because the developer committed code without documentation.

  • Need replies to call them interviews! (Score:5, Insightful)

    by Useless ( 11387 ) on Wednesday March 05, 2014 @02:36PM (#46411631) Homepage

    There have been a whole lot of these question threads without any replies in the past few months (6 other threads in the past 3 months, all unanswered). Do these people actually know they are being interviewed, or are these just empty topics posted to bolster lagging page views/ad impressions?

  • Do you have a plan to make OpenBSD widespread on the most popular wireless and wired routers, given that those boxes would benefit most from OpenBSD's security features? And in the process, gain more name recognition for your OS?

  • Exactly how much is "a heck of a long time" and for how much were those two remote holes exploitable ?

  • The last time I tried to run OpenBSD, it was so I could test our static analyzer Fortify SCA on the kernel.

    One thing that really held me back in my research is that processes were limited to about 1 Gigabyte of RAM each. What exactly is the reasoning behind this hard limit?

    Note: I never finished my work, but it would be totally cool to compete this someday.

  • Theo de Raadt: why the bitching about BSD code put in GPL?

    http://kerneltrap.org/OpenBSD/Atheros_Driver_Developments

    And that's not the only article I've seen about BSD advocates bitching about BSD code being put into GPL code.

    I don't get it. BSD advocates are fine with MS taking BSD code, and claiming it as MS code, and releasing only in binary. But, the BSD advocates bitch about BSD code being put into GPL open-source? WTF?

    As I understand it, BSD is almost public domain. I can take BSD code, and relicense i

    • Re: (Score:2)

      by rev0lt ( 1950662 )

      As I understand it, BSD is almost public domain.

      Its not. You retain full authorship, so deleting the license and pasting a new one directly violates the license.

      I can take BSD code, and relicense it any way I please

      No. You cannot remove the BSD disclaimer from the source and/or claim it as your own.

      If you want kernel improvements to be implemented back, why license your code under the BSD to begin with?

      One of the reasons TCP/IP is a huge success is because it was BSD licensed. As many fundamental daemons that gave name to some pretty well-known services that we now call "internet" collectively.

      When you release your code BSD, you allow relicensing. That's why MS prefers the BSD license.

      Also Apple. And every other sane company that doesn't do business selling "open source", but products with added value.

  • The OpenBSD project spends a lot of time on audits, but I know little about this process. How does it work? Do you just read the code and look for bugs based on experience? Do you use tools? Is there a audit-specific skill set that separates auditors from regular programmers? Are there specific books about audits that you would recommend? What is the best piece of code you have ever seen (or written?). Also, non-system programmers talk a lot about TDD and unit testing, but system programmers in general do n

  • Compiler upgrade (Score:3)

    by noselasd ( 594905 ) on Friday March 07, 2014 @06:29AM (#46426799)

    OpenBSD is built using gcc 4.2, which is getting old by now.
    While being old isn't an indication of being bad or wrong, is there any concrete plan
    to either upgrade the base compiler, replace it with clang or some other compiler ?

Slashdot Top Deals

news: gotcha

Close