Hacker News

OpenBSD is a very well kept secret that very few people are aware of. As close to nirvana as I can manage.

The fact I miss pretty much all the drama around the latest corporate take over attempts on Linux is just icing on the cake. The toxic slug strategy is an amazing one that more open source projects should use.

My impression is that the BSD's are laser-focused on providing efficient environments for networking backbone software to exist in, so special attention is paid to making it easy to orchestrate everything with rc.conf and keeping anything not required for these goals out of the default installation; while Linux (and its distributions) being far more general-purpose naturally will take more configuration.

Speaking of Linux, OpenBSD’s hypervisor (vmm) supports it so I managed to get docker and containers running on my server via Alpine Linux. Opens the door on all the latest ‘modern server stuff’ running happily on an OBSD box.

Have you dealt with hardware failure or instability yet? It can be pretty annoying to pin down and isolate, unless you keep an order of magnitude of hoarded hardware around.

Time and attention are always in short supply.

If I didn't need CUDA support, I'd be on FreeBSD all the way. No systemd, built-in "containers" before they were cool, basically just good 'ole UNIX.

I had similar issues with it. What helps today are LLMs. It’s really a boon to configuring such things. You do it on ace and forget unless that’s your job. Did you try to do what you had wanted back then with a recent LLM?

> - firewall? […] Wherever I looked, people said "it's complicated." After a lot of tinkering and learning I finally got a setup that was pretty safe. (I think.)

I felt this way about pf when I first got PF going around 2011 for my home router/firewall box. Not saying this is the same for you or anyone else, but my issue was that I was approaching it from the point of view of “I want to configure a home firewall router with PF” instead of “I want to learn the fundamentals of what a firewall does”.

It took me a few more years to get well-versed in all that stuff: the structure of packets, what NAT actually means (what addresses are being translated, why, and where), what's going on in the state table, how to debug when things aren't doing what I expect, etc. Once I did it became much more straightforward to express in my `pf.conf` what I want to do, but you're right that doesn't really help new users.

> Lots of pain and hard to find friendly, best practice starter templates.

FreeBSD does include this, however! It's just implemented using IPFW instead of PF. Check out `firewall_type` key in `rc.conf`: https://cgit.freebsd.org/src/tree/libexec/rc/rc.conf?id=edad...

For a very simple NAT gateway, one could set `firewall_type=simple` and then `firewall_simple_(iif|inet|oif|onet)(_ipv6)?` to configure the ISP-side and internal-side interface names and IPv4 and IPv6 network ranges for each.

For a very easy single-machine firewall, one could set `firewall_type=client` or `firewall_type=workstation` if you want to host anything. For the latter, `firewall_myservices` and `firewall_allowservices` control what ports are enabled and who (other networks/IPs) have access to them

For more details and to see exactly what each option actually does, check out `/etc/rc.firewall` where this is all implemented: https://cgit.freebsd.org/src/tree/libexec/rc/rc.firewall?id=...

https://docs.freebsd.org/en/books/handbook/firewalls/

> - firewall? Lots of pain and hard to find friendly, best practice starter templates. Wherever I looked, people said "it's complicated." After a lot of tinkering and learning I finally got a setup that was pretty safe. (I think.)

I don't use much FreeBSD these days, but pf (from OpenBSD, I know), is one of the best things since sliced bread.

In my first job I was working for a company selling a third-party vertical software and we were proving support for it. We were using a very expensive symantec vpn with most customers connecting with a 33.3kb phone connection, until we reached the license limits, and there was no money for new licenses. In a pinch, me and a coworker set up a new server with openvpn, freebsd, pf, and a ruby-based dns server that I don't remember anymore, and we grew an order of magnitudes more customers.

It's been more that 20 years, I still don't know how to use firewalls in linux, (there are many, I just pretend they don't exists) but I would still be able to setup a pf firewall if needed. I need to say it again, pf is a joy to use.

My gripe with FreeBSD right now is that I miss something like docker swarm. bhyve is fine but AFAIK it works only on a single host. Give me something that works on a bunch of hosts, and I will come back right away

- firewall?

PF seems to me like pretty much the most well regarded firewall there is - with a nice, sensible DSL for config. If you don't like like it, you can use use IPFW or IPFILTER, which are alternative, built-in, firewall front-ends.

- In the end, it was just too much having to re-invent the wheel for common server tasks

Maybe you have built your routine around a system that have reinvented the wheel? I think FreeBSD knowledge degrades more slowly than that of Linux distros.

- I'm just not an OS dev.

That's how I feel when I enter the chaotic Linux world. Do you think my life revolve around keeping up with this shit? :)

When we don't have convenience and rather jump into the sea directly, we would actually learn how the stack works and not how the convenience wrapper worked. We would feel more confident in our ability to do more things without requiring somebody else's help and more. It is this reason why figuring out this phase feels really important and lovely even, yet most people feel its hardness and leave it aside since they just want something which just works

Fortunately, for them, I think with technologies like docker/podman, flatpak, appimage etc. I feel like its already easy-ish enough.

Side nit pick but I hate when apps create docker/podman containers when they can also have flatpak, I would love to see some self hosting apps which have a gui or maybe even some cli hosted via flatpak but I rarely saw cli apps in flatpak etc.

I use it every day as my desktop OS. Vanilla FreeBSD even, not dragonfly.

I like it because it's so stable. They don't have this Linux thing where they have to change everything around to incorporate the latest fad, and there's also not so many big tech companies constantly messing with the code. Linux has too much corporate influence for me. I don't want Huawei or Amazon to be messing with the code I run all the time. The grassroots nature of Linux is kinda gone and the suits have taken over, just like with the internet itself.

I also love how the OS is stable but the apps are rolling. This really helps to be on the latest KDE etc. And the documentation is excellent. ZFS on root as a first class citizen too.

There's a small team of maintainers working hard to keep everything going in this age of increasing linuxisms. But so far they've been doing a great job.

Is this the fluffypony of Monero fame? If so, I got into FreeBSD a bit after hearing you praise it on crypto podcasts back in 2017/18. Surprised your handle was still available on HN!

Thank you for sharing the write up!

Not an OpenBSD expert by any means, but two small pieces of minor feedback as everything else you wrote mirrors my own setup and experience. Firstly, unless you are really strapped for space on say a 90s machine, it is generally recommended to install all the file sets as there can be interactions with ports even if one does not expect it (say ffmpeg needing X11 libraries). The general OpenBSD mindset is after all "Use the defaults" and the default is to install all the file sets. Secondly, the OpenBSD Handbook has a bit of a mixed reputation in the community from what I can tell. Unlike the FreeBSD Handbook, it is not an official document and I tend to rely on man pages, openbsd.org, misc@, and a few blogs I consider to be trustworthy instead.

As a final note, glad to see you have IPv6 up and running. I really should get around to it now that dhcp6leased has been in base for more than two releases.

I'm curious which aspect(s) became a time sink for you? I self-host a bunch of stuff myself. I can't say I never spend time on it, but it's measured in hours per year. Once stuff is set up, it just runs.

> [1] Looking it up, storing 45TB would end up costing anywhere between $250-$1500 a month pretty easily, which I currently cannot justify.

Or about $5k one-off at pCloud, which is still a big investment. (No affiliation, just a customer.)

I installed Jellyfin on my home server a few months ago but it’s already broken by upgrading to 10.11, and unusable until I restore 10.10 from backup or start over: https://github.com/jellyfin/jellyfin/issues/15027. There seem to be lots of other database migration bugs for this release and other ones.

All the utilities are not GNU, but BSD, so there are differences. But typically not a problem, as long as you move inside POSIX. Most GNU utilities (all?) can be installed if you prefer them. For example, make is typically gmake, and you really need it. I haven't used BSD for the last 10 years but used it from 1999 to 2015. I had never major issues.

Without looking or knowing all your requirements, it's likely everything you need works the same. (I don't know anything about gnu/coreutils.)

According to repology.org, FreeBSD is the 4th largest package repository in the open-source world.

Which type of applications? What I have found to be finicky is the desktop environments, however BSDs are pretty much tuned for web servers/applications. Bastille is designed for deploying web applications in jails securely and built on top of FreeBSD which is a pretty good default OS that gets out of your way already.

Normally you don't release an app for BSD specifically unless you want to offer a port. In which case software is usually built and if you need containerization you can put it in a jail.

It seems you would do well to install a FreeBSD vm/usb and give it a run. Their documentation is pretty good and their forums are helpful.

That's similar to me, I started using FreeNAS back in the 9.x days.

At the time the FreeNAS documentation recommend installing to a usb drive. This proved unreliable, but dedicating a drive to it was silly given it couldn't be used for anything else. I had all the things I needed but I wanted to peel back the layers and this seemed like a good excuse

So I threw in a drive and installed freebsd 10 and spent a few days familiarising myself with everything, learned how to configure samba myself, learned how to setup jails with iocage (the old shell version), and finally imported my pool.

Years later very little has changed.

They added binary packages.

How's the UX for jails these days? I remember trying to use it barebones and also some of the wrappers.

For FreeBSD, given that it fulfills the tasks required:

* Ease of management - more holistically designed.

* Rock solid parts that fits together - more holistically designed.

* ZFS, jails, bhyve, dtrace, ports.

* If it works today, it works tomorrow.

* A more approachable community (which AMD says is the reason why they are developing for FreeBSD before Linux now).

* Transparency and simplicity of how it works - if you can understand it, you can manage it and fix it.

* Documentation.

* Fun! Linux is not fun.

Less churn -> the OS respects the time you invest in learning the system, and the time people have invested in documenting the system.

What do you use Linux for?

If a single expert beginner can call the shots in your org, your org is the kind where that is absolutely fine.