<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom"><title>GNUcode.me</title><id>https://gnucode.me/feeds/tags/OpenBSD.xml</id><subtitle>Tag: OpenBSD</subtitle><updated>2024-05-01T13:21:27Z</updated><link href="https://gnucode.me/feeds/tags/OpenBSD.xml" rel="self" /><link href="https://gnucode.me" /><entry><title>Using OpenBSD for a Few Days</title><id>https://gnucode.me/using-openbsd-for-a-few-days.html</id><author><name>Joshua Branson</name><email>jbranso@dismail.de</email></author><updated>2021-11-27T11:52:00Z</updated><link href="https://gnucode.me/using-openbsd-for-a-few-days.html" rel="alternate" /><content type="html">&lt;p&gt;I love playing with my computer. I love tweaking things, adding new features,
trying the latest gizmo, etc. This usually means that I end up breaking stuff on
my computer, which is exactly what I did a few days ago! I normally find myself
running Guix System these days, and a few days ago, I attempted to boot up my
laptop and grub gave me this error:&lt;/p&gt;&lt;pre&gt;&lt;code&gt;error: file '/boot/grub/i386-pc/normal.mod' not found
Entering resque mode...
grub resque&amp;gt;&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Great. Well luckily, I have a spare hard-drive laying around with &lt;a href=&quot;https://openbsd.org&quot;&gt; OpenBSD&lt;/a&gt;
installed on it! So now I get to go play with it! I have been using OpenBSD on
my laptop for about 3 days now, and it has been a pleasant experience. The
OpenBSD guys have built a stable and useable OS! It is almost a free OS
as far as the &lt;a href=&quot;https://fsf.org&quot;&gt;Free Software Foundation&lt;/a&gt; is concerned, but it does
include some nonfree firmware for wifi cards.&lt;/p&gt;&lt;p&gt;Installing OpenBSD was increadibly easy. Surprizingly, I could not get FreeBSD
to install…no idea why. Anyway, I am running Xfce on OpenBSD, and it works
fairly well. I will say that Guix System is clearly faster (probably 'cause
linux is faster). In Guix things are snappier, but OpenBSD feels a little slower
to start applications. Now I will admit that I am using a hard-drive on OpenBSD
and a SSD on Guix system, so keep that in mind. Also I think OpenBSD has
disabled hyperthreading (which you can enable with &lt;code&gt;# sysctl hw.smt=1&lt;/code&gt;) in the
name of security, so that could be why it feels a little slower.&lt;/p&gt;&lt;p&gt;Also OpenBSD has &lt;em&gt;not&lt;/em&gt; embraced &lt;a href=&quot;https://wayland.freedesktop.org/faq.html&quot;&gt;Wayland&lt;/a&gt; yet, which is ok. Though for an
operating system that wants to be secure by default, I hope they choose to
support Wayland eventually. OpenBSD does have weird X issues. Nothing major, but
when I open gajim, sometimes it displays an Emacs buffer on startup, then
switches to looking like gajim. Or when I click to chat with a person on Gajim,
it can take half a second to open up the chat window. Again not a huge issue,
but it is noticable.&lt;/p&gt;&lt;p&gt;I had to edit various files and install various packages to set up OpenBSD to
the way that I liked. I already miss Guix's declaritive model of creating your
operating system from one configuration file! Though most of guix's
services are configured through &lt;code&gt;/etc/rc.conf.local&lt;/code&gt;. Here were some of the things that
I had to set up to get OpenBSD to work.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;p&gt;install various packages&lt;/p&gt;&lt;p&gt;doas pkg_add -iv gajim netsurf firefox font-awesome xfce xfce-extras mpv emacs&lt;/p&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;OpenBSD has &lt;code&gt;doas&lt;/code&gt; instead of &lt;code&gt;sudo&lt;/code&gt;, which you should &lt;a href=&quot;https://man.openbsd.org/doas.conf.5&quot;&gt;configure&lt;/a&gt;.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;p&gt;Get Xfce to start automatically after I logged in&lt;/p&gt;&lt;p&gt;cat ~/.xsession
exec startxfce4&lt;/p&gt;&lt;/li&gt;&lt;li&gt;&lt;p&gt;Enable autologin. Don't ask me for a password&lt;/p&gt;&lt;p&gt;cat /etc/X11/xenodm/xenodm-config | grep -A 1 -B 1 autoLogin
DisplayManager*autoLogin:       joshua&lt;/p&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;This one was weird, because I had to &lt;code&gt;chmod u+w xenodm-config&lt;/code&gt; in order to
modify the file. And this feels like cheating. I feel like the proper solution
is to modify &lt;code&gt;/etc/rc.conf.local&lt;/code&gt;, but the guides I found online suggested to
just modify the &lt;code&gt;xenodm-config&lt;/code&gt; file.  After I edited the file I ran
&lt;code&gt;chmod u-w xenodm-config&lt;/code&gt;.&lt;/p&gt;&lt;p&gt;It's also a good idea to configure your
&lt;a href=&quot;https://man.openbsd.org/login.conf.5&quot;&gt;login.conf&lt;/a&gt;. Specifically customize the
&lt;code&gt;staff&lt;/code&gt; section so your regular user has plenty of memory.&lt;/p&gt;&lt;p&gt;Since I have made my emacs config depend on &lt;a href=&quot;https://guix.gnu.org&quot;&gt;Guix System&lt;/a&gt;, I could not use it in
OpenBSD. So I thought, why not? I'll try out &lt;a href=&quot;https://github.com/hlissner/doom-emacs/&quot;&gt;Doom Emacs&lt;/a&gt;, which I must admit is
an awesome Emacs config. It's a little different using vim like keybindings with
the dvorak keyboard layout, but it is not a bad as I thought it would be.&lt;/p&gt;&lt;p&gt;Honestly, I am very pleased with OpenBSD. When I first started looking at
freedom respecting operating systems, I knew that I could try one of the *BSDs
or a Linux distro. I still feel like my home is in Guix System, but I wish we
were not dependent on Linux, which is becoming a bit of bloatware. The Linux
kernel is approaching 30 millions lines of code. The FreeBSD/NetBSD kernels are
approaching 9 million lines of code. Each have about 500 syscalls. In contrast,
OpenBSD has a little more than 2 million lines of code and 330 syscalls. It just
has a smaller attack surface.&lt;/p&gt;&lt;p&gt;If I was not convinced of the moral correctness of the FSF, then I probably
would be an OpenBSD user today, but it's good to know that if Linux ever
collapses under its weight, then I should be able to retreat to using OpenBSD!
Though it would be nice to see OpenBSD get more funding to pay developers to
work on it.&lt;/p&gt;&lt;h2&gt;Bonus Paragraph!&lt;/h2&gt;&lt;p&gt;So I realized later, that I had NOT broken my computer.  I could still
boot into Guix System, because I am running libreboot, which includes
Grub as a payload.  Apparently my libreboot setup, loads grub from the
hard drive instead of using libreboot's payload.  It would be nice to
actually use the libreboot payload and skip loading grub from the hard
drive.  That's a project for a later date.&lt;/p&gt;</content></entry><entry><title>Dual booting OpenBSD Guix System</title><id>https://gnucode.me/dual-booting-openbsd-guix-system.html</id><author><name>Joshua Branson</name><email>jbranso@dismail.de</email></author><updated>2021-07-19T02:29:00Z</updated><link href="https://gnucode.me/dual-booting-openbsd-guix-system.html" rel="alternate" /><content type="html">&lt;p&gt;EDIT: This &lt;a href=&quot;https://www.youtube.com/watch?v=3E9ga-CylWQ&amp;amp;t=563s&quot;&gt;systematic review of OpenBSD security
mitigations&lt;/a&gt;
points out some inaccuracies in the following blog.&lt;/p&gt;&lt;p&gt;I will be honest.  I have a little crush on &lt;a href=&quot;https://www.openbsd.org/&quot;&gt;OpenBSD&lt;/a&gt;.
When I first learned about free/open operating systems, I knew that I wanted to
use them.  But in my early days of knowing nothing about computers, my limited
research lead me to the conclusion that I could choose one of the *BSDs or a
GNU/Linux distribution.&lt;/p&gt;&lt;p&gt;When I was making my decision about what free/open operating system that I
wanted to run, I was intrigued by the code quality that FreeBSD, NetBSD,
DragonFlyBSD, and particularly the insane &lt;a href=&quot;https://lkml.org/lkml/2008/7/15/296&quot;&gt;masturbating
monkey&lt;/a&gt; behavior that results from the
impressive design goals of &lt;a href=&quot;https://www.openbsd.org/goals.html&quot;&gt;security, robustness, tracking and implement
standards (ANSI, POSIX, parts of X/Open, etc.), and
portability&lt;/a&gt; of OpenBSD.&lt;/p&gt;&lt;p&gt;OpenBSD is known as being one of, if not the most secure, operating system in
the world.  It has pioneered many security related features, many of which have
been ported to the other *BSDs
&lt;a href=&quot;https://en.wikipedia.org/wiki/OpenBSD_security_features&quot;&gt;including&lt;/a&gt;:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;W or X: you can either write or execute to a section of the hard
drive but not both.&lt;/li&gt;&lt;li&gt;secure replacements for strcpy and strcat, namely strlcpy and
strlcat&lt;/li&gt;&lt;li&gt;kernel randomization in that the linker randomly relinks the
kernel at every reboot or halt (this is awesome)!&lt;/li&gt;&lt;li&gt;changes to malloc to use mmap, &amp;quot;which was modified to return
random memory addresses…&amp;quot;&lt;/li&gt;&lt;li&gt;privilege separation/revocation and chrooting of common
applications&lt;/li&gt;&lt;li&gt;remove-all of outdated/underused code.  I read somewhere that
they removed the bluetooth support and are actively removing
old or outdated syscalls.  OpenBSD has 300 some syscalls and
the other *BSDs have 400 to 500, though I cannot currently
provide a reference for this.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Surprizingly, while openBSD is strives to be secure, security is
not necessarily the central focus, as lead developer and founder
Theo de Raadt &lt;a href=&quot;https://www.reddit.com/r/BSD/comments/af1itd/how_openbsd_is_secure_compared_to_other_operating/&quot;&gt;explains&lt;/a&gt; (I'm not certain if he actually said this):&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Many people think that is about security. It is not. Largely,
those standards are about accountability in the face of
threat. Which really isn't about making systems secure. It's about
knowing when your system's security breaks down. Not quite the
same thing. Please count the commercially deployed C, B, or even A
systems which are actually being used by real people for real
work, before foaming at the mouth about it all being &amp;quot;so
great&amp;quot;. On the other hand, I think we wil see if some parts of
that picture actually start to show up in real systems, over
time. By the way, I am surprised to see you list ACLs, which don't
really have anything to do with B1 systems.&lt;/p&gt;&lt;p&gt;As to the second issue, I have no idea what a distributed kernel
is, nor do I see how anything like that would improve security or
quality of a system.&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The OpenBSD developers are also prolific software developers:
&lt;a href=&quot;https://www.opensmtpd.org/&quot;&gt;opensmtpd&lt;/a&gt;,
&lt;a href=&quot;https://man.openbsd.org/httpd.8&quot;&gt;httpd&lt;/a&gt;, &lt;a href=&quot;https://man.openbsd.org/doas&quot;&gt;doas&lt;/a&gt;
(&lt;a href=&quot;https://flak.tedunangst.com/post/doas&quot;&gt;why doas?&lt;/a&gt;),
&lt;a href=&quot;https://sndio.org/&quot;&gt;sndio&lt;/a&gt; (a sound server), &lt;a href=&quot;https://man.openbsd.org/mandoc.1&quot;&gt;mandoc (manual page
generator)&lt;/a&gt;, and probably lots of other cool
things.  I currently am using opensmtpd as my
&lt;a href=&quot;https://gnucode.me/hosting-your-own-email-part-1.html&quot;&gt;email&lt;/a&gt;
&lt;a href=&quot;https://gnucode.me/hosting-your-own-email-part-2.html&quot;&gt;server&lt;/a&gt;, and it's pretty
awesome!&lt;/p&gt;&lt;p&gt;Also, there is some renewed interested in creating an &lt;a href=&quot;https://www.gnu.org/distros/free-distros.en.html&quot;&gt;FSF endorsed
distribution&lt;/a&gt; from the
&lt;a href=&quot;https://www.hyperbola.info/news/announcing-hyperbolabsd-roadmap/&quot;&gt;hyperbolaBSD&lt;/a&gt;
&lt;a href=&quot;https://itsfoss.com/hyperbola-linux-bsd/&quot;&gt;project&lt;/a&gt;.  They probably picked
OpenBSD because of it's amazing code quality and great documentation, BUT ALSO
OpenBSD is almost an approved FSF operating system already.  OpenBSD does NOT
include proprietary code in the base install, because this is a massive security
vulnerability.  So basically, I am now dual booting Guix System and OpenBSD, and
I have my eye on HyperbolaBSD.  I hope they are successful!&lt;/p&gt;&lt;p&gt;P.S. The OpenBSD installer was breath-takingly easy and painless!  If you've got
an old-ish Thinkpad lying around, you might want to give it a try.&lt;/p&gt;</content></entry></feed>