OpenBSD was Right - Linux Kernel Developer Greg Kroah-Hartman

[mr_beezlebub]

I’d have to agree with him. Linux needs to start valuing security again just as highly, maybe even more so, than performance. We don’t want to make the same mistake that Intel has made with their security.

[randomness]

OpenBSD, the makers of OpenSSH and so many more goodies.. of course they got it right, nothing compares.

[Lync]

I will gladly take a performance hit if it means enhanced security.

[viniciuscanovas]

OpenBSD has been right of all these years, and we are still counting

[NoEggu]

@0:49
"If you're running a system that you don't trust your users, you have to disable hyper threading."

What user actions makes spectrum and/or meltdown an issue?
What if you do trust your users (or you are the only user), what is it that you need to know to not do, so that you do not fall victim to the spectrum or meltdown vulnerabilities?

By knowing what to avoid doing, you can avoid the performance hit by not disabling hyper-threading. Is that correct?

[mzs]

OpenBSD was right about a bunch of things, just like how RMS was right about software, privacy, freedoms, etc.

[FreeMan-wzhj]

They were right for the "wrong reasons" until the Linux guys said disable hyperthreading. Damn, if wasn't a high-horsed statement I'd don't know what is...

[ZackaryYoung-ig]

The security over performance ideology should be taken seriously. In the modern time of hyperfast connections, speed is paramount. But the statement "OpenBSD was right" is the correct sentiment. Security cannot be understated. Security must be held as a priority, with performance as a necessity.

[taozg]

That was always true, from the very beginning..

And to think, Linus called all of us OpenBSD users 'Masturbating monkeys'. If you ask me, he's the clueless Computer School Dropout. Theo DeRaadt makes Linus look like a total amateur.

[hammerheadcorvette]

But this primarily affects Intel Processors right? So AMD cpu's should be ok to keep hyperthreading???

[SimonSchiele]

The one down-vote was Linus himself? :-D

[JustSomeGuy]

BSD and Solaris (and now it's derivatives) are better engineered then Linux. Popularity doesn't make something better.

[puffinrock]

Yes they were right, and YOU were WRONG. Not just on this one either Greg.

[gregoryperry]

Hello Theo,

Long time no talk. If you will recall, a while back I was the CTO at
NETSEC and arranged funding and donations for the OpenBSD Crypto
Framework. At that same time I also did some consulting for the FBI,
for their GSA Technical Support Center, which was a cryptologic
reverse engineering project aimed at backdooring and implementing key
escrow mechanisms for smart card and other hardware-based computing
technologies.

My NDA with the FBI has recently expired, and I wanted to make you
aware of the fact that the FBI implemented a number of backdoors and
side channel key leaking mechanisms into the OCF, for the express
purpose of monitoring the site to site VPN encryption system
implemented by EOUSA, the parent organization to the FBI. Jason
Wright and several other developers were responsible for those
backdoors, and you would be well advised to review any and all code
commits by Wright as well as the other developers he worked with
originating from NETSEC.

This is also probably the reason why you lost your DARPA funding, they
more than likely caught wind of the fact that those backdoors were
present and didn't want to create any derivative products based upon
the same.

This is also why several inside FBI folks have been recently
advocating the use of OpenBSD for VPN and firewalling implementations
in virtualized environments, for example Scott Lowe is a well
respected author in virtualization circles who also happens top be on
the FBI payroll, and who has also recently published several tutorials
for the use of OpenBSD VMs in enterprise VMware vSphere deployments.

Merry Christmas...

[DivergentDroid]

I used PC-BSD Isotope for a couple of years and really liked it although it was a little slow for a modern OS. (It's based on Free BSD) I have yet to try TrueOS (the newly renamed PC-BSD) and I've never tried OpenBSD - I would try OpenBSD IF they made a Desktop version. - " TrueOS (like OpenBSD) uses LibreSSL, instead of the standard out of the box OpenSSL that FreeBSD comes with." according to Wikipedia.. which is why I mention it. Perhaps I'll try TrueOS, if it's a desktop version that's just as secure as Open BSD.

[Lmao-kelq]

On intel, AMD doesnt have this problem

[Darkstar]

Why should I accept disabling HT, effectively almost halving my computing power, on a computer or laptop I use at home? I have a firewall, script blocker, pihole, but even without those I see absolutely zero need to run with HT disabled....
I agree it's probably good for cloud providers, but every single Linux PC and VM I run will have "mitigations=off" as the first thing I do.

[wonghow]

what is the point OpenBSD being right when OpenBSD is never chosen for renderfarms, servers, custom designed devices, phones, desktops, VM, productivity? Linux is the best choice for all of these. There are more contribution to Linux than any BSD.

[malloott]

Do those security guys ever care about the performance/watt impact these things have? There wil literally be tons and tons more CO2 emmited because of it.