OpenBSD 7.5 locks down with improved disk encryption support and syscall limitations The OpenBSD project's 56th release is arguably the most secure Unix-like OS to date. OpenBSD's point releases are no less significant than any others, and as such, OpenBSD 7.5 has some significant changes amid a lot of smaller ones. One of the biggies is very specific and quite niche, while the other is something that would be …
It's a bit tricky in that BSD had to remove any bits of AT&T code but AIUI it did evolve from the original academic distribution Unix tape and Ken Thompson spent a sabbatical year there plus a lot of contributions such as vi went back into Unix. On the whole I'd regard it as Unix, even if it isn't UNIX.
BSD started life at University of California Berkeley, as patches and additional tools for Bell Labs Research UNIX V6. Some of these changes found their way back to Bell Labs and were rolled into V7, and some of V7 went into later BSD. BSD and UNIX swapped code back and forth for several generations, until AT&T's lawyers noticed that UNIX was worth some money, at which point the BSD source was eventually sanitized, with all AT&T code rewritten from scratch by around the 4.3BSDs. This lead to the versions known as 4.3BSDTahoe... and Net/1. Then 4.3BSDReno and NET/2. NET/2 led led to the late, lamented 386BSD and then on to all the BSDs we have today, which at least to some degree continue the code swapping tradition.
By way of reference, the UNIX Wars occurred roughly between "lawyers" and "386BSD" in the above paragraph, with a small (probably ongoing) footnote from an upstart company with an assumed (purchased) name, known as SCO, happening later.
Also note that several other large companies (most notably Sun Microsystems, IBM and NeXT) and many Universities world-wide contributed to the early BSD work.
That's the tl;dr version, the details would fill a small book. It's a convoluted history.
So in a C shell, while BSD is no longer a genetic UNIX (as of the late '80s/early 90s), it is a spiritual UNIX, regardless of what the lawyers have to say.
OpenBSD is fantastic. It is the only OS I actually enjoy using. Feels clean and "boring" in the best of ways. Xenocara is great. Having a *clean* Xorg in base is the way to go; it simplifies package management so much.
The relatively small community of developers has done such a great job. The hardware support is often better than much larger projects. Possibly suggesting that their preference of developers vs users has some merit to it.
My only gripe with OpenBSD is power management. apm and bsdfreqd are not quite enough these days, Intel <pstate> or AMD <coolnquiet> make a big difference. 5W vs 11W. Likewise it seems bizarre that the Raspberry Pi doesn't have cpu freq scaling yet, I would have assumed the developers would have more interest in that platform. They do have working wifi on the Pi, so have FreeBSD beaten in some ways but just interest kind of stopped.
I used obsd fire years to run my server and laptop and my main reasons basically match the summary at the end of the article; it’s incredibly simple. The configuration is very obvious. Stuff isn’t hidden away. The base processes can be counted on a few fingers. It just works.
Unfortunately, I’ve been using Linux for the last …something… years now instead. All those attributes I mentioned above that I love? Yea - I miss all of them
And in case you are wondering (and I’m sure you’re not), the reason I started using Linux instead ….yea …. Why did I??
Oh, and as for the unfriendly installer. I never found any part of obsd unfriendly. It’s quite annoying to see this opinion persisting
> Oh, and as for the unfriendly installer. I never found any part of obsd unfriendly. It’s quite annoying to see this opinion persisting
Indeed. You can pretty much hold down the enter key without looking. You can't get more user-friendly!
The incorrect opinion must stem from people with a compulsion for a GUI. Well UNIX/Linux, etc will always be a disappointing experience for them.
> Indeed. You can pretty much hold down the enter key without looking. You can't get more user-friendly!
This is patently untrue.
Here, try it on my test box. It has Win10, FreeBSD, and 6 Linux distros, spread across 2 SSDs, one shared global home partition and one shared global swap partition.
You show me OpenBSD installing successfully on that, including a bootloader.
Otherwise, I call BS.
It has zero, nothing whatsoever, to do with whether it has a GUI or not.
> > Indeed. You can pretty much hold down the enter key without looking. You can't get more user-friendly!
> This is patently untrue.
That is more or less how I install OpenBSD, except I press it discretely rather than holding it. Sometimes I want a custom partition table or encryption or something else that diverges from the defaults. VM and tin.
OpenBSD doesn't deal with dual booting. That is an external problem.
> Here, try it on my test box.
I'm game.
To be fair, I too have some highly personal, quite idiosyncratic, some might say very eccentric, non-standard test boxen.
I would EXPECT to run into problems installing a fourth (fifth ... ) OS on any one of them.
That's why I always check out new OSes or distros on a fairly generic, freshly wiped, bare metal machine. Gives them a level playing field.
Nice review, as usual. It's Friday. Have a beer.
“Here, try it on my test box. It has Win10, FreeBSD, and 6 Linux distros, spread across 2 SSDs, one shared global home partition and one shared global swap partition.”
That’s not in any way a realistic platform to install ANY OS on. It’s bonkers!! If I wrote the installer I would be tempted to make it deliberately fail just to prove the point
And does anyone dual-boot anything these days? Never mind quadruple (or however many it is) boot?
> And does anyone dual-boot anything these days?
I'll admit to dual-booting: #1 Devuan to fire up VMs (such as the "end-user instance of Devuan" and Windows 10) then #2 Windows 10 bare metal.
But I admit that firing up the latter is down to my not getting fully to grips with the architecture of the PC: passing through a plug-in board (e.g. GPU, extra LAN) to a VM is easy(!) enough, but figuring out the mapping from the physical ports to the weird device ids for all of the built-in devices got so confusing that I gave up and boot to #2 when doing something under Windows that wants to access a USB device (other than keyboard, mouse or storage). I hang my head in shame.
[Author here]
> That’s not in any way a realistic platform to install ANY OS on.
That's why I do it. The whole point of a review is a challenge. A review that tells you that something works fine in the easiest case is no use, IMHO. You need to know if something can cope when the going gets rough. You need to know how it fails, and if it does so gracefully, or collapses in a heap.
It's the failures and the edge cases that are instructive.
I am not holding _Top Gear_ up as an exemplar here, but to test a car -- or a driver -- they drove it around a racetrack hard. You don't get in it and drive it very carefully in a straight line for 200 metres at 50kph and then go "it's great!" You try to break it. You see how it works at the very edge of its capabilities.
Almost all my kit dual-boots, yes. Linux is developing some reasonable firmware-updating tools now but it remains far behind and few ever even notice that these only work in UEFI boot mode. Some of my kit is too old to have UEFI at all, some has it but it's early and buggy, and some has nothing else -- and consequently can't run some of the OSes I've written about, such as FreeDOS and Arca OS. Firmware updates are important and Windows is better at them.
OpenBSD is for grown-ups, it is a tool and not a swiss army knife. What it does it does better than anything else and if you want to do what it does, you use it. If you do not know what you want, you would use Linux, the swiss army knife, if you have Windows, you are not entitled to an opinion.
"You show me OpenBSD installing successfully on that, including a bootloader."
To be fair, you just described a pretty extreme edge case that even most technically adept readers here would ever attempt.
Try wiping out your Windows install and re-installing that again, leaving all your others OSs in place and see how user friendly that experience is :-)
(I admit I may be out of date with the Windows install "experience", but the last time I installed Windows on a multiboot PC, it trampled all over the other OSs and boot loader without even pausing for breath, assuming it was the only OS I'd ever want to run.)
It really isn't difficult. I presume you have grub on your UEFI system, so create an entry for OpenBSD with chainloader /EFI/OpenBSD/BOOTX64.EFI in it, then install OpenBSD in a dedicated partition, copy BOOTX64.EFI to the EFI path, and it should boot. You can configure your global swap and global home to be used, this is ext2fs or some version of? OpenBSD can read/write that. Just ajust your user UID/GID in OpenBSD to use it. Nothing complicated in all this, for someone who multiboots.
OpenBSD trades pain and performance for a small footprint install that's hard out of the box. That, like Slackware on the Linux side, makes a great jumping off point for server images and VM's. (The new virtualized and encrypted disks you mention in 7.5 look nice for this). Add just what you need, build exactly what you want and noting more. My goto for VPN and SSH services. My preference for DNS and DHCP services. Handy as a ssh/sftp/tftp server for updating all the networking crap when it gets factory reset back to obsolete firmware.
What about the projects intentions makes it seem like a great choice for a desktop operating system? "Because I can" seems to be the most oft sited reason people try to desktop it. Pure masochism seems second. There are two other BSDs to chose from as well that offer an easier desktop experience, with broader hardware support and better performance. They aren't slouches on security either, and regularly steal non-crazy commits from Open.
The author gets a pass as it's their job to do this and write about it, as it is their job to point out little snippets like the bumps handling more complex partitioning of drives. I don't extend myself the same courtesy, even though I have done the same thing playing around with new releases. If I am loading an X server on OpenBSD, I know I am screwing around and I'm man enough to admit it. I think it's great the option is there, if for no other reason than to make it easier for new user to figure out how to get around in it.
For the rest of us using OpenBSD, strongly consider playing to it's strengths and leaving the GUI out of it. SSH onto it from something you can run your client side crap on, and don't even install a browser on your OpenBSD image. It doesn't need to be your only OS. It won't whine about being your side slice. It will just run workloads quietly and reliably for long periods of time without having to be futzed with.
For Unixlikes ever since my preferred Linux for servers decided to be no more because of corporate greed, I've been using and maintaining a whole lot of Free and OpenBSD, but I can't think of any of the OpenBSD machines having a GUI or a need for one. The smaller the attack surface the better, that's the whole point, and for where I work that's extremely important.
"Because I can" seems to be the most oft sited reason people try to desktop it. Pure masochism seems second."
Well done for using OpenBSD on your servers. From the OpenBSD FAQ
"OpenBSD is all free. The binaries are free. The source is free. All parts of OpenBSD have reasonable copyright terms permitting free redistribution."
So the OpenBSD project volunteers chuck a release over the wall now and again for us to use however we want.
Isn't it wonderful?
> OpenBSD trades pain and performance for a small footprint install that's hard out of the box
*Akshully* the OpenBSD footprint isn't specifically small. It includes an entire Xserver, window managers, web server and.... Perl!!!
However it is clean. If you were to install those using a package manager (even on FreeBSD), you would have a lot of clutter around. Xorg in particular on FreeBSD drags in loads of unnecessary stuff, including Python. At work we maintain our own version of it with all that stuff stripped out.
> Xorg in particular on FreeBSD drags in loads of unnecessary stuff, including Python
Yikes! Did not expect to read that today.
You have piqued my interest - let me guess, just a run-once setup thing; I'll just go and have a look. Nope, from around 2015 it seems to have originated from the use of clang, because Xorg uses language features that only a later clang supports and that pulls in Python as part of the build? Here we go, down another chain of weird dependencies.
Just stick[1] with K&R C, it doesn't drag in anything unexpected!
[1] Rhetoric! No need to tell me why there are "better choices since the 1980s"
I believe the newer LLVM is used for the gallium amdgpu and llvmpipe ... but OpenBSD still manages to get this right.
Weirdly the Python dependency is a completely "soft dep", you can wipe it after and even though the package manager will bitch, Xorg still runs fine.
OpenBSD with a DE (Xfce) and web browser (Firefox) on a Raspberry Pi 4.
Because I can.
Not painful.
Performance: not screaming fast; fast enough for what I do with it.
I’ve had it installed on a desktop computer. Very usable as an everyday computer. I haven’t gotten to replacing that computer after it gave the ghost, but I’m not missing it with the Pi 4 running as an adequate replacement.
> "The original idea behind Unix was that it was small and simple enough to understand everything on your computer – what it was there for, why, and what it did. "
This. I was using a linux system recently that had no jobs running, and no other users.
The amount of shite (mostly systemd) running would put Microsoft to shame
You realize it’s your choice to run a Linux distro with (or without) systemd, right?
What Bruce Schnier called, probably not originally, lead pipe cryptoanalysis but lead anything let alone pipe is harder to come by so a $5 shifter but these days $5 would not buy enough of a wrench to hurt anyone - at least not in these parts. (Note the 'r' in wrench otherwise even less likely to get a result. :)
If you're using it as a club instead of as an actual wrench, head for Harbor Freight[0] for this 18+ inch beauty at a bank-busting $8.99:
https://www.harborfreight.com/hand-tools/wrenches/hitch-ball-wrench-95494.html
Or perhaps this one, which makes up in mass for its lack of length ... 8 inches of solid steel for only $3.99:
https://www.harborfreight.com/hand-tools/wrenches/pipe-wrenches/8-inch-steel-pipe-wrench-39641.html
Or perhaps you'd prefer its big brother, the 10 inch model at only $5.49:
https://www.harborfreight.com/hand-tools/wrenches/pipe-wrenches/10-inch-steel-pipe-wrench-39642.html
You're on your own for the lead pipe. Perhaps head to Florida? It'll probably come as no surprise to anyone reading here that Florida leads the nation in lead water pipes ...
[0] Note: That's the name of the place, and so there is no need for my usual "harbo(u)r".
...and you can run out of disk space.
Sure, if you use a 16GB virtual disk or partition. See photo. Try your local computer store and ask them for a 16GB disk drive....the 2000-oughts called they offered one for $1000...
Try 50GB for virtual disk size and you can fit the source and even rebuild things if you are so inclined. Or use a real machine with that size or larger.
As always with OpenBSD, if you don't "get" it then you aren't the target audience.
rudimentary and rather user-unfriendly installation program
1. 1,$ s/user-unfriendly installation program/non-techie-unfriendly installation program/g
For techies, the installer is a godsend, particularly on dev boards where all you've got is a serial port and no x86-style video display.
2. You can partition OpenBSD to use a single file system, with everything mounted under '/'. I've got it running on 4GB netbooks that way. It's better to, if you can, carefully-partition it into multiple filesystems. I have done this with 8GB netbooks. I have done this comfortably with larger-sized flash drives (16GB, 32GB).
3. You can make a low-spec netbook far-more usable with OpenBSD if you add a 32GB+ SDCard to that netbook, and partition such that the high-frequency-write portions live on the netbook's SSD, and the less-often-written portions live on the SDCard.
4. If you don't use the "hibernate" feature, you don't need a swap partition (this also is true for Linux). Omitting swap saves write fatigue on your SSD, and works just fine, even with just 2GB RAM.
> As always with OpenBSD, if you don't "get" it then you aren't the target audience.
If you are arguing that literally at the start of the install process then it makes it hard for anyone to ever find out enough to be able to "get it".
But that is a good response if you want to keep it restricted to the self-back-patting cognoscenti.
> All cognoscenti start out as non-cognoscenti
Which is exactly my point (the comment you responded to): and to gain knowledge and experience you need to be able to start using the thing, and learn what "it" is and then figure out how to "get it".
But being told from the first instance, as Bitminer told us, that you can not even hope to *start* because you do not "get it" from the very beginning is just a way for Bitminer et al to gatekeep and *prevent* others becoming cognoscenti.
No idea what your use of "proud" is about in the context you use it: from my p.o.v. it was Bitminer being a proud gatekeeper.
But, clearly, looking at your response (and others' votes) my desire to want get to grips with stuff without hitting gatekeepers is unpopular around here.
> It was a totally valid criticism for the author to make.
Thank you!
This is one part of the point here. I know it's cheap now, ridiculously cheap, but 16GB is a _lot of space_. OpenBSD is a relatively small, relatively simple, relatively lightweight OS. It supports quite a lot of platforms:
https://www.openbsd.org/plat.html
Including SH4, NewWorld PowerMacs, and i386. These are low-end late-20th-century kit. It is reasonable to expect a low-end OS whose download ISO is about 700MB and would fit on a *CD* -- not a DVD -- to easily fit and have room to spare in 16 _gigs_ of disk, some 20x bigger than the download.
But it doesn't. That is highly unexpected to me. And things which are highly unexpected are the very bread and butter of reviews.
[2]
There is a larger point here:
Yes, this complicated partitioning scheme brings benefits, but it also brings high costs. It is extremely space-*inefficient* and could leads to unexpected and unforeseen system failures due to the disk filling up.
That sort of issue is the sort of thing one needs to know about.
[3]
Then there is the question of what you do about it.
*Because* it is so complicated, *because* the installer does not explain much and is ultra-minimal, it's very hard to change. You can't just take a few gigs off one partition and add them to another.
That is richly needed but the installer doesn't do it.
When installing macOS onto a machine with a blank disk, when you tell it you want 2 partitions it automatically reassigns space. Add 3 and it balances the disk usage. That's good. That would help here but the installer doesn't do it.
You folks are focussing on the UI and it's not about that at all. I expect and need to be able to say "I will install 2 -- or 4 or 8 or 16 -- extra gigs of software. Ready yourself for that" -- and for it to just happen. It doesn't. You can't. That's bad.
The only way to deal with this are 2 bad solutions:
* by simply turning it off -- at the cost of reduced security.
* by simply giving it lots more disk space -- which is an unexpected penalty in a low-end system.
Improving security has a price, which is _reducing_ system stability and making it _more_ likely to fail due to a disk filling up. That's the opposite of hardening a system.
[4]
In other OSes you could work around this by using graphical partitioning tools such as Gparted, but you can't here. OpenBSD doesn't seem to support such things, and existing tools that can handle Linux and Windows and other OSes don't work on OpenBSD disk volumes, even if you mount the disks under an alien OS.
That's bad.
[5]
Complex disk partitioning like this was quite common in the bad old days of 1990s proprietary Unix. The vendors recognised it was problematic and they fixed it by inventing dynamic disk partitioning systems, Logical Volume Management and so on.
There are solutions to this kind of problem and they are _old_ solutions. They'd really help here. OpenBSD could adopt one of multiple FOSS LVM storage management tools and this issue would just _go away_ while at the same time retaining security, retaining its complex partitioning and the benefits thereof, and retaining simplicity of deployment...
... But it doesn't do that kind of thing because its developers and its admirers don't see the problem.
That's the sort of thing that it is a reviewer's job to bring to light.
So I see some valid comments here. I was not intending to be some kind of "gatekeeper" but if you want to believe that, go ahead.
Liam reviewed (twice) the default configuration result. He did _not_ review the documentation:
The installer will create a partitioning plan based on the size of your hard disk. While this will not be a perfect layout for all people, it provides a good starting point for figuring out what you need.
As some have already pointed out, custom partitioning is supported and, it seems, frequently used. Like, for example, by me:
$ df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/wd0a 8.7G 6.8G 1.4G 83% /
/dev/wd0d 30.0G 24.6G 3.9G 87% /home
If at first you don't succeed, try, try again. Sure it's annoying after a lengthy download to find /usr/local is full. That is part of the learning curve.
My point was this: if you want an install to succeed the first time, use a big disk.
.....not only do you need LOTS of disk space....but you also need to know where Flatpak might want to load stuff!
Yup.......if (like me) you aren't an OS expert.....make sure you have lots of disk space (in all the partitions your OS chooses to create and use)!!!
This post has been deleted by its author
This post has been deleted by its author
This post has been deleted by its author
Posted a few days again about things annoying about OpenBSD like still limited to NFSv3 and UFS in 2024 and those are warts for sure. Last time had problems getting it to recognize my sound card and had to hack the source to work with my network card but things are working much better now almost out of the box. Might make a go of it one more time. Its sparse for a desktop but that's the point and it has many advantages. Used OpenBSD for years in VMs and on USB sticks but lets see if we can go full daily driver.
Postscript nobody cares about: Finally went back to using it as a daily driver along with triple boot of Linux and Windows in rares cases doesn't have what I need. Security first, simple with little bloat. Performs well enough and gets by on its feature set. Lot to like. Always did like it for no other reason the default shell is old school ksh like HP-UX and many others. Much closer to the original UNIX ethos than Linux and most other OS these days.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
