> https://www.openbsd.org/images/PinkPuffy.png

> Apparel (t-shirts, so far): https://openbsdstore.com/

Interesting.

In the image you linked (PinkPuffy.png), the cat's hat says "security." In the OpenBSD store, the cat's hat reads "POLICE" on several of the shirts.

Interesting to see OpenBSD continuing to gain hardware support. I've been running it on a small home server for DNS/DHCP and the stability is remarkable. The man years of auditing really show.

Will be interesting to see if Theo leans into AI ... and starts having AI generate the release artwork & songs.

I tried OpenBSD recently and found it behaves very differently from other OS. The same code works on Linux/FreeBSD/Windows but has poor multi thread performance on OpenBSD, async socket stopped working after sending at high speed for few seconds. I am not saying there is anything wrong in OpenBSD, it is just different.

If you care about security, why not consider Qubes OS? Related discussion: https://forum.qubes-os.org/t/qubesos-vs-openbsd-security/790...

Unfortunately the hardware support isn't there for many systems.

If I had to pick a BSD, it would be FreeBSD anyway.

Is OpenBSD actually more secure than Linux? I have not been able to find any data to support this—only some vague opinions.

Openbsd makes a good stopgap.

The way forward is seL4[0][1].

0. https://sel4.systems/

1. https://microkerneldude.org/category/sel4/

What? How long did it take?

>it’s time everyone considers OpenBSD

https://x.com/ortegaalfredo/status/2055362910415671459

When your super secure feature gets defeated by a symlink maybe it's not really time to consider it...

Sure, things are not better in the linux world but at least there's more eyes to fix issues there just because of the market share.

OpenSMTPD was substantially rewritten in 6.4 (2018). It is the best SMTP server for the majority of use cases. Unfortunately, the portable version has been weakly supported, so it's usually only OpenBSD users than learn how great it is.

I'm happy with it. Been running OpenSMTPd for many years at this point, on both OpenBSD and Linux, and I have no complaints.

I really like OpenSMTPD; no nonsense and configuration feels rather modern compared to the legacy stuff that's out there.

Surprised exim was dropped from ports. It is not like it was ever in base. I guess the maintainer did not want to anymore.

We use OpenBSD for our VPSes on Hetzner, bare metal (for security focussed clients) and older (but still good) hardware in our Home Lab. OpenBSD is excellent on older (no longer supported by Cupertino) Apple hardware. We have an Intel Mac Mini Cluster with near-perfect uptime. If you need to run any kind of server (Web, Mail, DNS, NFS, Database) where you need stability & security, look no further. Some learning curve, but totally worth it.

I use it on my personal laptop, essentially because I like how slim and simple it is.

Packaging is simple, kernel development and upgrade is simple, etc. Also the kernel code itself is written in a style I like, it's to the point, no useless abstractions, no fuss. I prefer it even amongst other BSDs I tried (netbsd and free*lbsd/dragonfly).

It just feels nice to be able to understand most of your system. It's not as fully featured as Linux, but there is a sense of understanding your system that is refreshing. A bit like if you're on vacation in a small and cute village where life is mundane and calming. At least that's how I feel with it. Mileage may vary.

I run it. Home firewall, office desktops and laptops. It's pretty stable and I'm fairly familiar with it. Really simple if you know Unix. I hope it never goes away, not sure what I would replace it with. Linux is so complicated now, it's just too much for me to deal with

My wife and I are building a wedding rentals company. I'm responsible for the digital part and building a Ruby on Rails app deployed to OpenBSD. The entire thing runs on a cheap Supermirco U1 server in a rack at our home. :-)

I use it for my home router, a small home server, a personal VPS at https://openbsd.amsterdam and a development VM (mostly for testing BSD backends on portable software).

I wish I had an OpenBSD development laptop, but I don't have one right now.

open-bsd will always feel like a safe pick for anything in regard to vault or key holding ; it's not appropriate to run anything CPU intensive - but it's a very appropriate system for anything that just need to boot up and hold some data ; eventually expose a network interface.

I use it. It's secure, and if your hardware is supported it mostly just works. A good unix experience if you're willing to learn its intricacies

Authoritative DNS (nsd) and email (opensmtpd) runs out of the box with minimal config on very low ram kvms. The documentation is fantastic, installation is easy; sysupgrade has been a big improvement, though I wish they'd slow the release cycle a little

I use it for home router, my laptop, several vms for various services, and on one vps I keep around should I need to quickly set something up. I keep a proxmox server for anything I can’t or won’t run on OpenBSD.

Been running it as my home router since 2.3. I had it on a server for a very short time when I used hardware RAID but I replaced that quickly with FreeBSD for ZFS once I could afford to replace that old Dell.

I ran it on my personal laptop for several years when I had one, but having a work laptop for these past decades I don't have much use for a personal laptop. I would probably run it again on a nice portable when I retire. It would be nice to focus on being creative on such a machine. Coding and drawing mostly. I will continue to use Linux in my recording studio though.

I've been running OpenBSD on my main laptop for about a decade, as well as on routers. It has the most consistent and well-designed interfaces of any modern *nix other than arguably macOS.

It has been my daily driver for years.

It is, by far, my first choice for a router/firewall. It has so many niceties for this, all well integrated OOTB, and you can deploy something top notch in no time at all.

I use it for my mailserver (thank you openbsd.amsterdam), for the gateway in my homelab, a dedicated OpenBSD VMD machine in my homelab, and on personal machines (Macbook Air M2, a Thinkpad X220 and on a T480 that dualboots OpenBSD/FreeBSD).

For mailserver I think it is the best option. And for Gateway, PF is just wonderful.

But even on my laptops I enjoy it. It is rock solid, and I have pretty much no complaints.

Web/SSH/mail server using the built in httpd, sshd and smtpd. Very happy with it.

And on my laptop, occasionally, to experience it in person.

Single tenant(and single core) tiny VMs with OpenBSD's VMM hypervisor and confidential computing through AMD-SEV.

Not really, but OpenBSD has been in my life for 25 years.

I used OpenBSD to create the firewalls for our LAN parties when I was at school.

The first shellserver I ran, on an UltraSparc IIi was OpenBSD, gave out accounts to my friends.

And then I used it as a firewall, both professionally and personally, for many years. Until the first Turris Omnia was released, and now I have retired even Turris for pfSense, which is FreeBSD I believe.

But the PF firewall in OpenBSD was superior, definitely to the syntax of IPtables.

To me Linux was a great server OS, and OpenBSD was a great FW/Gateway OS.

Runs well on my Lenovo T-490. I use this as my main non-Windows laptop.

Running OpenBSD 7.9 with KDE 6.6.4. Desktop usage.

My home router, firewall and VPN gateway is an OpenBSD box, Intel N100 with quad 2.5G Ethernet. To be frank, Linux has better support for fighting bufferbloat with FC-CoDel, but pf is so much saner than Linux firewalls it's not even close.

WiFi is handled separately by a Ubiquiti UniFi system, but I don't trust Ubiquiti not to exfiltrate data after their underhanded attempt to turn telemetry on a few years ago. OpenBSD WiFI is somewhat mediocre, but it has improved in this release with experimental support for WiFi 6 after years of being stuck at 802.11n.

The closest you will get to the OpenBSD experience on Linux is with Alpine Linux.

I use OpenBSD for my home server. Runs everything from httpd to a Minecraft server.

I do. Multiple things:

Work: I need a simple easy to use system that I can configure to meet third party compliance requirements without jumping through hoops. It really excels when you can mostly use the base system there, maybe couple services. For example it's so nice to just have a couple pledge/unveil lines for example in a Go service.

Also super nice for "set and forget" style stuff. For example "I just need a HTTPS server with acme and SFTP". That's something you get out of the box with no third party packages (so everything vetted, pledge/unveil for everything, maintenance just running syspatch and sysupgrade), which is really nice.

Personal: Private mail server, family website, a quick and dirty "watching streams together" service I set up to watch stuff with people not in the same place as I am. prosody to have XMPP for friends and family.

I would NOT use it for "people throw stuff at you" use cases (Linux and FreeBSD do a far better job there). But I absolutely love it for scenarios where you want very very low maintenance. For example that private email server. I don't have time to do big upgrade plans, or "hardening" systems or reinventing the wheel. I cannot afford to do privately what I do in a day job or consulting (setting up or maintaining really rather complicated infrastructure).

I have done that many years with Debian, but the Linux world sadly is a big complex and complicated mess. That's great, when I get paid to deal with it, but annoying otherwise.

And I don't mean that bashing wise. I use Linux, I like Linux, but somehow there is a huge drive to overengineering and then building hacks and weird workarounds that become normalized until it's a proper job. Without wanting to start a flame war, but the whole Docker, Containers, Kubernetes, Helm, Orchestrators, etc. story is a lot of reinventing the wheel and a static executable like a Go service in a container, so essentially coming with a whole Linux distribution even though one never thinks about it that way is just really absurd. That's what executables, processes, etc. were invented for.

And since I've lived through the story and as mentioned make a limit, I understand how that came to be, but it feels like the industry took a wrong turn because it was cool and exciting and then (nearly) everyone decided to use that hammer for everything one could imagine to be a nail. And then the next layer came and the next and the next. But all of them doing things differently. And suddenly to have a Postgres cluster you need Kubernetes, and Helm, but also need to know both PG config and the orchestrator's config, etc.

It's a mess and the OpenBSD people somehow knew that decades before I did.

I’ve been using it on an old PC Engines router (great hardware, by the way! I wish they were still around.)

It ran for over 8 years without downtime, but I’ve had repeated problems in the last year or so.

I used the default partitioning scheme, which makes /usr tiny, and /var huge, and since it is a router, did not install X11.

At some point, they made x11 mandatory for auto updates. This is dumb, because all the upgrade tool is doing is untarring a list of tarballs. So, I had to perform partition surgery from the upgrade ramdisk to make room for X11.

Now, they made some ASLR relinking scheme mandatory, which makes sense, except the relink directory is 1.5GB (larger than the entire rest of the distribution, and far larger than the parts I voluntarily installed!).

For some reason the relink output files go in /usr, which, by default, won’t hold it at upgrade. It really belongs in /var, because it is not immutable, and also, there’s room there! So, I had to repartition the router from a rescue environment again.

They also removed the ability for ntp to sync on machines without cmos clocks, and the alternate config options don’t seem to work. That’s a bit more niche, granted, but my router hw is reasonably common for openbsd use and has that property. You can make it work by using a second utility to force clock sync at boot.

I like that they keep things simple, but they also recently pulled out any semblance of power loss safety for their file system. I’ve had to serial console in a few times to run fsck, which isn’t really the behavior I want from the home router!

They don’t have any way to setup DDNS in the base install, so you have to use a port or pkg. The port I chose was EOL’ed by upstream (ISC), so I’ll probably need to switch to dnsmasq as a dhcp server / dns server, which is fine, but those services are a significant fraction of the attack surface of my router. DDNS seems like a pretty simple thing to implement, and would be really high value for router use cases. Without it, I’d have to assign static addresses to everything on the LAN, then edit DNS records.

I think all this stuff is fixable, but wish they’d take the niche of “rock solid secure infrastructure” a bit more seriously. This used to be a nice “set and forget” weekend project but now it requires attention every few release cycles.

7.8 barely managed to fit in my duct tape and bailing wire partition layout. I’m probably going to switch to freebsd on a box with faster NICs when I finally get a > 1GBit internet connection (hopefully in the next year or so).

If I upgrade to 7.9, I’ll have to give up on using the openbsd hypervisor, since, with the partition scheme that the installer chose, there will no longer be a partition large enough to hold the download sets and also the vm image.

This is particularly frustrating because the boot drive is under 50% full. I’d just do “one big partition”, but they warn against that for good reason - it complicates manual fs repair at boot.

Anyway, I really like the project. It would be nice if they did a “fix common papercuts” release, since I doubt many users are as patient as I am.

If you are looking to install it, either use fewer partitions, or way over provision storage (I was 10x over provisioned at install, and the stuff I use hasn’t grown more than 10-20%) and also make sure you choose much larger partition sizes than recommended. This will add under $100 to your hardware cost, even with the storage shortages.

I needed to create a backdoor network-level KVM contraption to help my dad relocate some servers. tl;dr an office was closing down, he pulled the rack and stood it up in his basement. I mailed him a unifi edgerouter 4 that was reflashed to run openbsd. On boot it would create a vpn tunnel to a vps and basically expose a public WAN port to the rack. So it was in my dads garage on his Fios internet, but from a networking perspective it thought that it was in a Linode datacenter.

The ER4 has 3 ports: 1 was for the uplink, one exposed the WAN connection to the rack, and then the 3rd port became a client inside of the network. I could shell into it from home (he's on the other side of the country) and operate from the residential network and also the server network simultaneously. Worked well enough for a few weeks to keep access around until we could engineer a better solution.

Configuring OpenBSD was really quite simple and rewarding. No insane linux network stack / netplan / cloud-init / bs ... just a few conf files.

obligatory pic: https://i.imgur.com/Mkf9ckc.jpeg

> And even for background tasks shouldn't it be better to have them complete faster for less power

Race to idle is only clearly beneficial for tasks that have a clear start and end. If a background task is sustained, responds to unpredictable events, or does small amounts of work and wakes frequently, the CPU's boost logic won't solve your energy usage problem.

> To say nothing about what if they have different features. what happens when a process that wants to use cpu feature X(avx512?) gets scheduled on a cpu without X

This idea has been proposed in the past, but isn't actually used on x86-64 or ARM. E-cores have the same instruction set as P-cores, so there's no risk of running into an invalid CPU instruction.

Truly heterogeneous instruction sets may come back in the future, though. So be on your toes.

"Parking" lock is a reference to this:

https://webkit.org/blog/6161/locking-in-webkit/

It's a lock/mutex implementation that puts the blocked thread to sleep, usually via cooperative yielding to the scheduler instead of continuing to perform CAS operations on the lock continuously. Spinlocks have great performance when they're not heavily contended and the locks are held for short periods of time, but if either of those things are true the blocked thread can easily consume an entire CPU core while it's blocked.

Once you have workloads that can't tolerate a power cut + running fsck for a potentially long time, a battery backup becomes an excellent investment. I bought a UPS on eBay for cheap and my home server hasn't gone down since.

fsck is good. I have to hard reset my laptop a few times and I didn’t have corruption. Maybe a server has a different risk profile, but journalized systems are not file backup, which is what you should focus on.

* https://www.openbsdhandbook.com/multimedia/#bluetooth-audio

Removed in 2014.

The sole set of wired headphones in my house is for my OpenBSD laptop.

Interesting! Curious which Bluetooth device(s) you can’t live without.

Firmware backdoors in wireless chipsets are a really big attack surface, and disabling wireless at least gives you the chance to monitor five eyes activity on ethernet.

That's too bad. I might need bluetooth on keyboard, mice, headphone/earbuds, etc. OpenBSD seems so nice, but right now it is limited to running as a server, and not a desktop, which could be considered a good thing, as it focuses on simplicity. However, I do wish it had more hardware support.

EDIT: Running openBSD in a VM might get me the best of both world, with hardware support on host OS (linux/win) and the benefit of running OpenBSD.

It should be done in userspace, but then again, so should everything else[0].

0. https://microkerneldude.org/category/sel4/

You can often build generic dongles for pretty much anything on the cheap if that really matters to you.

E.g. I use the Seeed Studio XIAO nRF52840 for my BLE keyboard.

They did for awhile, but removed it due to complexity and security issues.

I always check their releases to get the song, like in other thread.. last song was 7.3

I recently updated an older OpenBSD router and firewall and the amount of native IPv6 support right out of the box makes this an unbelievable breeze.

Nice! Had to lookup when one was last released, 7.3. https://www.openbsd.org/lyrics.html

I dual boot OpenBSD on it, and it's been doing fine. The out of the box experience is pretty bare although the default window manager cwm is surprisingly nice once you get to know it. Note that apmd, the power management daemon used to manage CPU speed and low-battery suspend, is not enabled by default. The high-DPI screen required some adjustments in Xresources (I haven't dared try a multi-monitor, mixed DPI setup).

NetBSD seemed okay to but I've only used it a little bit. It actually set up X pretty well for the screen using some built in script with heuristics to determine font size from the screen metrics.

There's been a bunch of progress on FreeBSD, and OpenBSD isn't that much worse

No wifi driver for Framework 16. Was fun installing (and surprisingly quick) and playing around a little. But unfortunately that's a dealbreaker for me.

Power management, webcam, trackpad, accessories, etc tend not to be a good fit for niche BSD and Linux. Stick to desktop or server.

Yes free from American restrictions. Because America law prohibits from giving out cryptography to outside countries so according to OpenBSD we outsiders have no luck in getting a cryptographically secure operating system except for OpenBSD

Developed at 4500ft elevation in the Texas of Canada, primarily.

Agree. It's obvious some people are still having fun making operating systems!

Agreed. I also like that code doesn't get committed without a quality man page.

OpenBSD's primary purpose is to create artwork (https://www.openbsd.org/artwork.html), releasing an OS is a side project.

FreeBSD is mainly server focused. There's been work on the desktop recently, but it isn't what FreeBSD devs are paid to focus on. To be fair to the people paying them, it's a damn good server OS.

Also, check out DragonflyBSD. It has a really nice filesystem and Dillon does good work

I have used OpenBSD as a desktop for 7 years. Though my usage and the machine were minimal. But I thoroughly liked it. I want to go back to it. One good thing is that if your hardware has some problems or about to have problems then installing OpenBSD will make your computer kernel panic. So I use it as a diagnosing tool for my hardware

I always wanted to get into bsd, especially openbsd. I like the idea of a more cohesive os.

But I don't really know what to use it for to get started. My desktop runs linux with steam for games. My AI server needs rocm drivers so ubuntu-server. My vps runs debian, maybe that one, but there is no DO image for BSD. Open for ideas..

The main differences between OpenBSD, FreeBSD, NetBSD and DragonFly BSD

https://unixdigest.com/articles/the-main-differences-between...

Cannot edit, again the easiest upgrade of an OS, I did kitchen chores during the upgrade. The network was a bit slow, but got my work done during the upgrade :)

It depends. You can expect a 5 to 15% performance hit depending on the task. In OpenBSD, security comes first and performance comes second.

Works fine on my phone. Maybe it's you.