Hacker News new | past | comments | ask | show | jobs | submit login

Semi-related: is anyone here using OpenBSD in their daily DevOps setup? If so, why did you choose it (say, over Linux or FreeBSD)?



Yes. I've commented on this sort of thing before, but my preference for OpenBSD over other things really boils down to the Just Works factor, and the simplicity and transparency of the system. I usually find that getting things going on OpenBSD is straightforward and well documented, which saves me time and aggravation. The offline factor is handy for my work, and OpenBSD really shines here.

I think the more interesting question is why OpenBSD over Linux (which distro?) or FreeBSD. For me, this comes down to preference for simplicity, an absence of weird abstractions over top of simple things like networking, and confidence in the quality of the base system. I like FreeBSD and happily use it in several instances (freebsd-update is pretty great for online updating), but have had very mixed results with Linux systems (mostly debian and ubuntu). Sometimes things work, and sometimes I waste hours trolling through internet forums trying to figure out how to make it do what I want.

Really though, if you want to know what the difference is, you should just try it. Pull down the ISO, fire up a VM, do the install, and then try to get some work done. Take the time to read the man pages for afterboot, pkg_add and rc.conf.local, and you'll be on your way. The worst that could happen is you don't like it..


Hm, my only problem with my FreeBSD VPS is that ruby is terribly slow... I think it's the VM that slows down the ruby interpreter. Other than that, as you said BSD is way easier to maintain and configure because of it's clarity and documentation compared to Linux.

On the other hand you can find documentation for Fedora and Ubuntu server in terms of blog-posts for just about everything.


Curiously, the reasons that you use OpenBSD are the reasons that I use Linux, it Just Works for me and I've had problems when trying to use BSD.

As I talk to more people about it, there seems to be a growing pattern that, it's just whatever system you grew up with is the one you're most comfortable with, and is the one you're most likely to use going forward.


I grew up with linux. Back when slackware was king. I've always found it to be a constant source of irritations and problems. I tried out openbsd in 2001 or so and immediately jumped ship. And since then linux and most distros built on it have only gotten more complex, while openbsd has not. There is definitely more to it than "whatever people are used to".


I grew up on linux as well (still use arch at work and at home). But for anything serious, use OpenBSD. Its just great.


Can you please provide some details on how OpenBSD is better than X for your purposes?


Thanks for such a thorough comment. What web browser do you use? Does it involve building from source? Ports? Thanks and cheers!


Most of my work is server side (vim!), but on a client I just install firefox-esr with pkg_add. If there's a security update that I think I need, I'll 'make package' on the -stable branch in ports, and install that package wherever I need it. The -current branch keeps up to date with firefox pretty well if you want all the new features, but -current tends to move faster than I'm willing to keep up with.


OpenBSD is what I use to host a bunch of private sites for myself and a few people I know. This is only due to some custom configurations and applications that my shared webhost didn't provide and for things I can't be bothered with, like my own domain which is static html. I put them on the shared host.

I wish it was for a lofty goal like security and "code correctness" etc... but the honest answer is that it's extremely simple (once you get used to it) and I tend to be extremely lazy at times. Configuration is very straightforward for a lot of things and there have been very few surprises along the way. Actually no surprises that I can recall in most of what I do since 5.0.

I wouldn't recommend it as a desktop system although plenty of people (including my boss) use it as such. There is some fiddling required for this that I'd rather not do, but for very simple, stable and surprise-free servers, it works very well for me. I also wouldn't recommend it for first-time admins either, although their man pages are some of the most thorough and helpful I've ever read.


> I wouldn't recommend it as a desktop system although plenty of people (including my boss) use it as such. There is some fiddling required for this

I've been running OpenBSD on a laptop (which works as my desktop) for years now, and I can say there's been very little fiddling. In fact it's proved to be the best out-of-the-box experience I've had with any OS (including Windows XP and a whole bunch of Linux distros).

> I also wouldn't recommend it for first-time admins either

I have to admit I wasn't administrating things for the first time when I did it on OpenBSD.. but OpenBSD was so simple and straightforward that I eventually lost the will to fiddle with other systems.

They really have gone out of the way to make sure the system is Dead Simple to configure (the best configuration is no need for any configuration at all!), and when you really need to change something, the documentation is unparalleled.

Of course, different people have different needs so what works for me might not work for everyone. I know that what seems to work for most people doesn't really work for me...


> I've been running OpenBSD on a laptop (which works as my desktop) for years now, and I can say there's been very little fiddling. In fact it's proved to be the best out-of-the-box experience I've had with any OS (including Windows XP and a whole bunch of Linux distros).

I think with any BSD, trying to run it on modern hardware will be a frustrating experience as it lags behind Linux in hardware support (which itself lags behind Windows/OSX). Of course, BSDs are more coherent OSes and if it were not for hardware support I would use it exclusively.


I use OpenBSD on my laptops and desktop. The KMS drm drivers have been improved for 5.6. So you have 2D/3D acceleration, and unlike with FreeBSD, Xorg just works without configuration out of the box.

For a more "desktop" experience, OpenBSD 5.6 also has working GNOME 3.12.2.

One thing that tends to trip up desktop users is the default ulimits, BSD has login classes which may need to be tuned in login.conf(5). This is especially true if you plan on using modern web browsers which are resource hogs.


It seems I have to revaluate my stance on this. I admit, it's been a while since I ran OpenBSD as a full desktop. I've been happy with Crunchbang Linux so far as a simpler system, but maybe it's time I tried it again.


I have to say I recently made a similar choice; I chose FreeBSD because I could easily download an ISO for it though.

The documentation is exceptionally good, and the simplicity for configuration is a nice bonus.


OpenBSD has had downloadable ISO for a long time. It is easily reachable from ftp or http. FreeBSD's site requires for and takes more clicks to get to.


After reading this post I went looking, looking over the FTP site I did find an ISO. Thanks.

My memory was always that ISOs were hard to find, and when I didn't see a big flashing link I guess I tuned out.

I'll revisit OpenBSD in the future, for the moment I'm enjoying FreeBSD though.


I installed freebsd on an old laptop (thinkpad t60) because I want to use something simple, very well documented, and with an emphasis on good code. I know OpenBSD takes this further, but I know FreeBSD has more packages/ports available, and I'm interested in playing with ZFS and jails.


The problem with FreeBSD is that it has almost no security features turned on by default. It's more unsafe than windows and much worst than Linux.


FreeBSD is the only mainstream operating system that I know of which has absolutely no ASLR by default to this day.

Thankfully, it looks like they're finally gonna get there soon: http://www.bsdcan.org/2014/schedule/events/452.en.html


  > The problem with FreeBSD is that it has almost no
  > security features turned on by default.
What security features would you like to see turned on by default?


Stack protector for one. Though they finally did that. http://marc.info/?l=freebsd-stable&m=141495893928493&w=2


Yeah. Just saw that recently too. Good news!

ASLR is apparently around the corner+ as well.

Didn't OpenBSD get ASLR in 2008 or something like that? It only took 6 years for FreeBSD to get it.... >_<

  +for some definition of corner.


First OpenBSD commit to add ASLR was Sep 2003. Released in 3.5 on May 1 2004 (also the first release to support amd64).


Thanks for the clarification!



I hack on my OSS project on OpenBSD exclusively. I'm a stickler for good documentation, and the BSDs IMO are far better than Linux.

I use OpenBSD because 3-4 years ago I discovered a bug in the FreeBSD kernel that meant my OSS project wouldn't work. When generating lots of IGMPv2 packets on FreeBSD I could consistently cause the kernel to panic. I wrote a bug report, but I'm not a kernel hacker so I just switched to OpenBSD.

Manpages in Linux are atrocious, and each distro has their own way of doing things that only half works. I don't like GNU info, and Googling for docs is unacceptable. I often work in places with no Internet and I need the doc with me.


No one likes GNU info...


This is very true, its navigation is awful. Luckily there is one programme that makes info pages less annoying to browse. It's called 'pinfo', feels similar to lynx, and although it doesn't show from the website, it's a useful tool, nicer than the regular 'info'.

http://pinfo.alioth.debian.org/


I guess I'm biased as an Arch user but I've found their documentation to be leagues ahead of everything else I've used. That said, it doesn't solve the offline access issue you raised and the BSDs are firmly in second place.

That said, I've been starting to care quite a lot more about security and code correctness in light of recent events and have been waiting for today to install OpenBSD on my machine.


You'd put the bsd handbooks in second place after the Arch wiki? The FreeBSD handbook seems a lot more impressive and coherent to me, so does the OpenBSD documentation.


They're a bit hard to compare imo. The FreeBSD documentation is more coherent but also more focused/narrow, covering only the base system and a few common extensions. The Arch documentation is less coherent, but quite extensive, covering almost everything. I think the Arch wiki is less good as a proper manual, something you'd sit down and read cover to cover as an introduction to the system. But one thing that's nice about it is that it's really a one-stop shop: if you want to know what some package does, how it works, and how to configure it, it's probably there. If it doesn't play nicely with Arch or needs a workaround for common issues, chances are it's documented there too. Whereas with FreeBSD you're good as long as you stick with the base system, but it's a wilderness once you venture out into ports, with documentation/tips/workarounds scattered across the web, forums, mailing lists, StackOverflow, etc.


I guess he meant compared to other various Linux distribution docs; in that case I can only agree with him.


> That said, it doesn't solve the offline access issue you raised

https://www.archlinux.org/packages/community/any/arch-wiki-d...



Further related, does anyone know of a rented server company that offers OpenBSD? Ideally a sort of Linode for OpenBSD, although I understand with the virtualization fun that's mildly unlikely to be a 1:1 equivalence.

I can't be the only person that wants to deploy Linux based services piped through pf on OpenBSD and doesn't want to get into colocation.


I've been a happy customer of ARP Networks [0] for about five years now (running Linux, FreeBSD, and OpenBSD hosts). I've pretty much moved everything off to my own servers (since I work for an ISP and can put whatever I want in our datacenters) but I do still have one VPS hosting a few websites.

Native IPv6 is enabled on every host which, as a network engineer, is a huge plus for me. Physical location is at One Wilshire in Los Angeles and ARP has great connectivity and lots of peering.

It's a small operation which, depending on your point of view, can be either a good thing or a bad thing. There is no "instant provisioning" (or wasn't, the last time I ordered a new host) so it may take a day or so for your host to be available for your use. On the other hand, you can often catch the owner in #arpnetworks on freenode and chat directly with him (or get quick answers to (general) questions from other happy customers). He's also on HN occasionally, if memory serves.

[0]: https://arpnetworks.com/


TransIP in the Netherlands offers OpenBSD VPSs https://www.transip.eu/vps/operating-systems/


I'm using filemedia[0]'s KVM-based offering. It supports custom ISOs (you can open a ticket to get a new ISO uploaded), so installing OpenBSD (5.4 at the time) was quite easy. You just have to make sure to use DHCP and not a static IP in the network configuration, otherwise the network stops working a few months later when the DHCP lease expires.

They also have a new Xen (PV or HVM) oferring, but I don't know how well OpenBSD would work with that.

Another possibility is iwStack[1], another KVM-based hosting provider.

[0] https://www.filemedia.de/ [1] http://iwstack.com/


RootBSD (https://www.rootbsd.net/services/virtual-servers-vps/) has OpenBSD VPS's (I'm guessing it'll be a little bit before they have 5.6 available).


You can install it yourself actually, even if they don't offer it right away.


I use. And mostly I use for consumer internal applications.

Why:

1. After install sometimes I do not have access or prompt access to the machine;

2. It is safe and the need for updates are minimal.

It works..


I don't think you're using the term "devops" very well.

http://en.wikipedia.org/wiki/DevOps

Are you asking if OpenBSD is part of people's workflow, or if it is part of their permanent infrastructure?


Not really DevOps, but it's my main ("desktop") OS. I know it well, it's pretty damn secure, and it's an excellent development environment - good docs and lots of features that crash bad software.


No not at work. At home I use it on my two routers, one alix and one apu board.

I ran into a huge backset with openbsd at work 3 years ago when I wanted to run two redundant load balancers with carp in vSphere. Turns out I had to enable promiscuous mode on an entire port group to make it happen. These days we use virtual switches so maybe it's easier now but in those days we did not want to do it because it would mean enabling promiscuous mode on an esx host adapter, affecting everyone on that host.


This is not OpenBSD's fault. It's VMWare's limitation in their vSwitch that by default disables broadcast traffic.

XenServer has it worse -- no option to turn it on at all.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: