Talk:OpenBSD

Fixed a few spelling errors

Someone must have really thought license was spelled licence...

207.179.226.195 (talk) 15:22, 25 June 2009 (UTC)

Welcome to English, I have corrected your nonsense. 74.13.51.199 (talk) 22:24, 27 June 2009 (UTC)

Automate archiving?

Does anyone object to me setting up automatic archiving for this page using MizaBot? Unless otherwise agreed, I would set it to archive threads that have been inactive for 60 days and keep at least four threads.--Oneiros (talk) 18:51, 18 December 2009 (UTC)

Spoken Wikipedia recording

Hello, I just uploaded an updated version of the audio recording. I fixed the pronunciation of "de Raadt" and made other updates. I tried to overwrite the original file (it was moved to the Commons: http://commons.wikimedia.org/wiki/File:OpenBSD.ogg), but it wouldn't let me because my Commons account is too new. If someone can sort this out, that would be awesome :-).

I've uploaded an updated version of the Spoken Wikipedia audio recording. Since my Commons account is much older now, it allowed me to overwrite the file that is on the Commons. This file is no longer the most recent version. Please let me know if I've made any mistakes. Thanks. --Mangst (talk) 01:00, 29 September 2010 (UTC)

The article critical of OpenBSD

I have added it and it was reverted without good reason. The article was quite neutral and raised many interesting points worth of discussion. More than that, it made the rounds on almost every major news site and was discussed throughout the community. It is not original research or an opinion piece, it just points out the current state of the OpenBSD teams rejections of MAC with many references.

The only reason not to include this article is to try and hide criticism, which is dishonest. —Preceding unsigned comment added by 97.104.82.1 (talk) 07:15, 10 March 2010 (UTC)

Your link does not work. The only relevant article on OpenBSD I find on Distrowatch is here.--Oneiros (talk) 11:54, 10 March 2010 (UTC)

What do you mean the link does not work? The link is an edition of the DistroWatch newsletter that specifically references the article! Scroll down and you will see it! Alternatively there is an OSNews article here: http://www.osnews.com/story/22773/_quot_The_Insecurity_of_OpenBSD_quot_ 97.104.82.1 (talk) 19:36, 11 March 2010 (UTC)

Yes, it works. Did you read the comments to the article? Why do you link to the summary but not to the whole article? How relevant is an anonymous blog article?--Oneiros (talk) 23:41, 11 March 2010 (UTC)

I've removed it again: It fails WP:SPS—"For that reason self-published media, whether books, newsletters, personal websites, open wikis, blogs, Internet forum postings, tweets, etc., are largely not acceptable."--Oneiros (talk) 23:46, 11 March 2010 (UTC)

What crap. This is part of the reason people criticize wikipedia, when they employ double stanards in enforcing the guidelines. In this case the people in charge of the openBSD article are very pro OpenBSD, and won't let anything negative about it be placed on the wiki page.

I linked to the news site referencing the article, because I felt it allowed it to be more official. I also thought reading the comments would be interesting for many people. While the guideline you pointed to is generally good to follow, it does not apply to that article. That article made the rounds on all the news sites, slashdot, digg, linuxtoday, osnews, distrowatch etc, sparked a LOT of discussion and raised many good points. It isn't new research, just observations backed by references.

Wikipedia, and even this OpenBSD article, is full of similar articles. Opinion pieces that got carried by news sites. When the news item is prominent enough and raised points and was discussed in the community, it should be mentioned. Hell, even the MUCH larger discussion about OpenBSD vs SELinux isn't mentioned on this site, which makes me thing accuracy is not the goal, but rather putting OpenBSD in a good light.

From the guidelines you referred me to, "if the information in question is really worth reporting, someone else is likely to have done so.". The opinion piece was carried by almost every tech news source, so obviously it is worth carrying. So then, why is it not worthy of being a reference? 97.104.82.1 (talk) 07:48, 12 March 2010 (UTC)

I don't know where you get the idea that only positive items appear in this article, as far as I am aware all of the major specific, attributable criticisms that illustrate something about OpenBSD are covered - the DJB bunfight, the Adaptec NDA brouhaha, Felix's scalability tests, Linus' process criticisms. I spent quite a lot of time finding sources for criticism of OpenBSD when this article was rewritten and as you have noted, even many of the ones included are not ideal - you may be surprised at how few criticisms there actually are, and how difficult it is to find good, citeable references, even for something that comes up "time and time again". OpenBSD is not a huge project after all.

Of course, if a new criticism is made by a reputable source, it should be added. However, until this blog article was published recently, I had not heard lack of MAC cited as a serious criticism of OpenBSD for quite some time, so pending more sources, I'm not convinced we need to expend a lot of space on this. If one good source can be found, maybe a sentence around the stuff about privilege revocation?

I think a point to remember is that this article is not a review of OpenBSD, or a complete history, it is an encyclopedia article intended to give the reader (the technical reader, hence the prerequisites) an understanding of the history of OpenBSD, where it came from, its major features and goals, and the main attributes of its culture. We can't cover everything - a big thing about the article during FA review was its length, and a lot of time was spent paring down the article to examples that give a good flavour of OpenBSD, rather than trying to be exhaustive. For example, we do not mention the fuss over the use of GPL code in OpenBSD, or over removal of copyright in Linux, because they would not really say anything not already adequately shown by the sections about DJB and about Adaptec.

There are definitely a few other things could be improved, for example to my mind there are too many lists of binaries, APIs, security features etc, and there is some criticism that actually isn't cited when it really should be (no services in the default install). NicM (talk) 00:56, 16 March 2010 (UTC).

This bit seems to be unreliable, we'd want something more significant than what comes off as an editorial. Is the writer a notable security expert? Have they published papers? Mandatory Access Controls are not a security tool really, more for administration, but if that is to be construed as security, that angle can be pursued. http://allthatiswrong.wordpress.com/2010/01/20/the-insecurity-of-openbsd/ does not look like a security site, the other articles talk of Nip/Tuck and Buffy the Vampire Slayer. 74.13.38.99 (talk) 16:26, 13 March 2010 (UTC)

The blog site has a security category which has quite a few notable articles and entries. The fact that there is also an entertainment category on the blog should be irrelevant. Not really sure why you are trying to say that MAC is not a tool, but more for administration. MAC is a security technology like W^X or systrace, and should be discussed. OpenBSD is almost the only modern operating system that refuses to incorporate them without any good reason. This should be discussed or at least mentioned on the page. 174.58.203.226 (talk) 06:33, 14 March 2010 (UTC)

The blog is just a random blog - it's not some security blog, or even a blog by a security expert. It leaves the blog as just a bunch of random thoughts, which are not reliable sources of citable information. This isn't Bruce Schneier, Kurt Seifried, or Colin Percival, this is random guy. Citing an opinion piece of a non-notable individual does not work, and as the article is Featured already, only citable sources can be used. If you can get this person to turn this into an article, have the data as verified by the editors of whatever security-related site you encourage them to submit it to, then it's good to go, but until then, it's not noteworthy enough to be cited. Or at least, that's my thinking. 74.13.38.99 (talk) 12:45, 14 March 2010 (UTC)

Response to Third Opinion Request:

Disclaimers: I am responding to a third opinion request made at WP:3O. I have made no previous edits on OpenBSD and have no known association with the editors involved in this discussion. The third opinion process (FAQ) is informal and I have no special powers or authority apart from being a fresh pair of eyes. Third opinions are not tiebreakers and should not be "counted" in determining whether or not consensus has been reached. My personal standards for issuing third opinions can be viewed here.

Opinion: While the original piece may (or may not) be completely correct blogs and news reports which merely report the contents of the blogs — or worse, like the one in question here, just quote it — are not reliable sources. I would have ordinarily preferred to see the information remain up and just be tagged as of questionable reliability, but there's no chance that this meets WP's reliability guidelines. A suggestion to 97: If this has been widely reported, then there's a chance that one of those reportings takes this blog posting and builds an bigger, independent article around it, but just doesn't report it or rely on it as the sole source of the article. If that's in a reliable publication, that article might stand a chance of surviving here.

What's next: Once you've considered this opinion click here to see what happens next.—TRANSPORTERMAN (TALK) 17:34, 13 March 2010 (UTC)

Hi, thanks for your input. As noted when I made the request, my IP has changed. I do feel you have missed the point somewhat. I would also ask why the guideline states "if the information in question is really worth reporting, someone else is likely to have done so." but when I provide references that report the article they are ignored. The original DistroWatch article does not simply quote the article but reports on it, but it was dismissed. In any case, I think the hundreds of comments on that article substantiate it. It is not self published research, just a review of the current state that is well referenced. Wikipedia is full of these types of articles, and the double standard of when to cinlude them or not in frustrating.

As a compromise, I would like the thread on the official OpenBSD mailing list linked to, or this kernaltrap article (http://kerneltrap.org/OpenBSD/SELinux_vs_OpenBSDs_Default_Security) which also references a huge thread on the OpenBSD mailing list incorporated. OpenBSD is one of the only, if not *the* only modern operating system to not just not include, but flat our reject any form of MAC. This keeps coming up again and again with the 2007 thread and the wordpress article being the biggest examples. As such, the teams rejection of MAC merits inclusion on the OpenBSD page. 174.58.203.226 (talk) 06:33, 14 March 2010 (UTC)

You said, "Hell, even the MUCH larger discussion about OpenBSD vs SELinux isn't mentioned on this site, which makes me think accuracy is not the goal, but rather putting OpenBSD in a good light." Well, you're half right and half wrong. Verifiability, not accuracy, is indeed the bottom line for inclusion in Wikipedia. Both what you are arguing on this talk page about OpenBSD and the original piece may be god's own truth, but "The threshold for inclusion in Wikipedia is verifiability, not truth—what counts is whether readers can verify that material added to Wikipedia has already been published by a reliable source...." Reliable sources are, "third-party, published sources with a reputation for fact-checking and accuracy" and questionable sources "are those with a poor reputation for checking the facts, or with no editorial oversight". It's that last clause about "no editorial oversight" that prevents blogs, mailing lists, and other self–published sources from being reliable. The idea is, obviously — though I've never found anywhere here that says it outright — that Wikipedia depends on information coming from sources which have a substantial risk of financial loss through legal action or loss of reputation if they include as fact or criticism information which is not correct. That's the reason that blogs and sources like Kernaltrap are not considered reliable sources: they don't have any skin in the game. The "established expert" exception logically (though, again, not expressly, so far as I can find) is, in my opinion, really just a variation on the financial loss idea: an established expert has a reputation to maintain and risks substantial financial loss if it is tarnished. I understand your frustration at seeing something removed which you consider to be a well-documented public risk, but so far you've not come up with any source for it which, in my opinion, stands a snowball's chance of surviving a reliability review for the reasons set out above. As for the "half wrong," the position taken here about your attempted inclusion has nothing to do with bias in the OpenBSD article; the standards I've mentioned are applicable to every article here. If violations exist, it's only because either they've not been spotted or because no one who has noticed them has cared enough to mark, remove, or correct them. (We are, remember, all volunteers here; no one has to undertake tasks that they don't want to do.) If you find violations of those standards in the OpenBSD article, or in any other article here, you are free to mark, fix, or remove them, but I would strongly recommend having a very good understanding of the editing process and Wikipedia rules before you jump in. (At the very least, you should read, if you've not done so already, the Verifiability policy from which the foregoing quotes were taken and "What Wikipedia is not".) Good luck and best wishes, — TRANSPORTERMAN (TALK) 21:54, 15 March 2010 (UTC) P.S. You're missing the point about the statement about self-published sources which says, "if the information in question is really worth reporting, someone else is likely to have done so." What that means is that if self-published information is really worth putting in Wikipedia, then if you look hard enough you really ought to be able to also find it in some reliable source, i.e. one with a reputation for fact-checking and accuracy and which has editorial oversight, and not have to rely on the self-published source, even if the author is an established expert. — TRANSPORTERMAN (TALK) 21:56, 15 March 2010 (UTC)

I don't think a discussion of criticism of OpenBSD with regard to MAC would be out of place, but the comments should a) be attributable to some reliable source with at least some sort of credentials to speak on the subject (well-known security authority or author, developer of security software - the PaX guys might be good to look at, I think they have made comments in the past) b) include discussion of responses from/the attitude of OpenBSD developers (their responses to this blog entry may be usable, but I don't think this piece is enough on its own). I know it can be very difficult to find good sources on open source software and its debates, and even harder with a strict interpretation of the WP guidelines, but there must be more out there than this if it is a hot issue. Although I think it is important to bear in mind that this is an article specifically about OpenBSD, not about security, MAC, or other platforms, so it has to keep to the point.

As far as reasons against MAC in OpenBSD go, ISTR that at least a few broad reasons it doesn't exist have been stated at one time or another (but don't quote me on this, you will have to dig out sources): a) it adds unnecessary complexity and tentacles all over the place b) for most installations it is futile as administrators end up turning it off c) difficulty of formulating an acceptable default policy d) the existing solutions may be less fine-grained but they are well-tested, well-understood, simple, and (importantly) can be applied by default e) nobody has done it and submitted it and spent the time necessary to get something in (generally if someone turns up with code, it gets serious consideration) NicM (talk) 23:16, 15 March 2010 (UTC).

I can't find a lot of solid stuff on this so far, so I'm not sure it is yet really a big enough issue to deserve much, if any, space in the article. The best references I can come up with are:

• seifried, back in 2001 and very sketchy, http://www.seifried.org/security/os/20011107-openbsd-linux.html, and his own rebuttal http://www.seifried.org/security/os/20011107-linux-openbsd.html
• Another blog, Joshua Brindle: http://securityblog.org/brindle/2008/03/30/secure-doesnt-mean-anything/

There are also quite a few much weaker links, including:

• This thread http://kerneltrap.org/mailarchive/openbsd-misc/2007/9/22/272545 is quite good for OpenBSD quotes (look at Ted Unangst, Marc Espie).
• Stephen Smalley "The security portion of the OpenBSD project is really orthogonal to the SELinux or TrustedBSD projects" http://www.nsa.gov/research/selinux/list-archive/0103/0276.shtml

It would be interesting to know if eg "Mastering FreeBSD and OpenBSD Security" says anything about this difference between the two platforms? NicM (talk) 23:49, 15 March 2010 (UTC).

More recent screenshot

The current screenshots seem to be somewhat outdated. I've taken a more recent one in the hope of showing that OpenBSD can make a pretty decent desktop too: http://devio.us/~dv/OpenBSD%20with%20GNOME%202.30.1.png. If Nobody minds I'll replace one of the existing screenshots at some point. —Preceding unsigned comment added by 193.77.153.149 (talk) 22:39, 13 May 2010 (UTC)

May be better if it's a higher resolution, and maybe showing something other than xterm. 74.13.28.209 (talk) 16:30, 14 May 2010 (UTC)

Funding by DARPA

I suppose that the article should mention that OpenBSD was denied of a DARPA grant due to de-Ra'at's statements regarding the war in Iraq: [1]. Tzafrir (talk) 17:33, 15 December 2010 (UTC)