Re: Only two holes in a heck of a long time, but why?

2014-04-08 Thread Mihai Popescu
So, Martin, what is your point ?

Re: Only two holes in a heck of a long time, but why?

2014-04-08 Thread Stuart Henderson
On 2014-04-07, Kevin Chadwick wrote: > previously on this list Stuart Henderson contributed: > >> > If a port is considered dangerous like wireshark was it >> > is removed to avoid encouraging it but users can still build it of >> > course. >> >> There's a problem with *not* hav

Re: Only two holes in a heck of a long time, but why?

2014-04-07 Thread Alexander Hall
On August 27, 2014 10:16:21 PM CEST, Kevin Chadwick wrote: > ... Kevin, FYI, your time is horribly off...

Re: Only two holes in a heck of a long time, but why?

2014-04-07 Thread Kevin Chadwick
previously on this list Riccardo Mottola contributed: > Yes, sysmerge is really neat. Perhaps I should expand as to why if it has been so long without him using. sysmerge handles everything in /etc! via etc??.tgz and xetc??.tgz and lets you do quick diffs (which I shamelessly copied from for my

Re: Only two holes in a heck of a long time, but why?

2014-04-07 Thread Kevin Chadwick
previously on this list Stuart Henderson contributed: > > If a port is considered dangerous like wireshark was it > > is removed to avoid encouraging it but users can still build it of > > course. > > There's a problem with *not* having it in ports too, if people do compile > it

Re: Only two holes in a heck of a long time, but why?

2014-04-07 Thread Chris Bennett
On Sun, Apr 06, 2014 at 03:38:17PM -0700, Chris Cappuccio wrote: > Chris Bennett [chrisbenn...@bennettconstruction.us] wrote: > > > > X is also built in. > > Gee, base is so insecure!! > > > > X is a security disaster > Most of the internet sites I use work just fine with lynx. vi works ok. I

Re: Only two holes in a heck of a long time, but why?

2014-04-06 Thread sven falempin
On Sun, Apr 6, 2014 at 7:00 PM, staticsafe wrote: > On 4/6/2014 18:38, Chris Cappuccio wrote: > > Chris Bennett [chrisbenn...@bennettconstruction.us] wrote: > >> > >> X is also built in. > >> Gee, base is so insecure!! > >> > > > > X is a security disaster > > > > <> ? Naaah it's just bad. (stil

Re: Only two holes in a heck of a long time, but why?

2014-04-06 Thread staticsafe
On 4/6/2014 18:38, Chris Cappuccio wrote: > Chris Bennett [chrisbenn...@bennettconstruction.us] wrote: >> >> X is also built in. >> Gee, base is so insecure!! >> > > X is a security disaster > http://media.ccc.de/browse/congress/2013/30C3_-_5499_-_en_-_saal_1_-_201312291830_-_x_security_-_ilja_v

Re: Only two holes in a heck of a long time, but why?

2014-04-06 Thread Chris Cappuccio
Chris Bennett [chrisbenn...@bennettconstruction.us] wrote: > > X is also built in. > Gee, base is so insecure!! > X is a security disaster

Re: Only two holes in a heck of a long time, but why?

2014-04-05 Thread Predrag Punosevac
On 04/03/14 22:04, Martin Braun wrote: ... > Maybe I am just plain stupid, but could someone explain to me the point in > "bragging" about only two remote holes in the default install, when the > default install is useless before you add some content to the system, > unless you're running a web ser

Re: Only two holes in a heck of a long time, but why?

2014-04-05 Thread Riccardo Mottola
Hi, Martin Braun wrote: By easier to maintain it means "apt-get update; apt-get dist-upgrade" which is freaking neat! You can say what you want about Debian, but their apt system is exceptional! Especially between versions. it is getting a bit off-topic, but yes... I stand to that. I tinker wit

Re: Only two holes in a heck of a long time, but why?

2014-04-05 Thread Riccardo Mottola
Hi, Can you please give an example of a maintenance task that is easier then the comparable/analogous task in OpenBSD? ^ Because I remember Debian kinda sucked when I used it in 1998. apt-get update; apt-get dist-upgrade between

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Jan Stary
On Apr 05 00:06:56, yellowgoldm...@gmail.com wrote: > >> but eventually began using Debian > >> because it was much easier to maintain > > > Can you please give an example of a maintenance task > > that is easier then the comparable/analogous task in OpenBSD? ^^

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Juan Francisco Cantero Hurtado
On Fri, Apr 04, 2014 at 07:48:50PM -0400, John D. Verne wrote: > On Apr 4, 2014, at 18:06, Martin Braun wrote: > > >>> I used OpenBSD back in the 3.x days, > > > >> The last 3.x release was 8 years ago. > >> Are you fucking serious? > > > > Yup. > > > >>> but eventually began using Debian > >>

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread John D. Verne
On Apr 4, 2014, at 18:06, Martin Braun wrote: >>> I used OpenBSD back in the 3.x days, > >> The last 3.x release was 8 years ago. >> Are you fucking serious? > > Yup. > >>> but eventually began using Debian >>> because it was much easier to maintain > >> Can you please give an example of a ma

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Thomas Pfaff
> No! > > By easier to maintain it means "apt-get update; apt-get dist-upgrade" which > is freaking neat! > > You can say what you want about Debian, but their apt system is > exceptional! Especially between versions. Yes, truly exceptional. I had a blast upgrading from Sheesh to Whoosy, or wha

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread ag@gmail
apt-get though seemingly simple, brings in shit load of libraries with names resembling alien species. Try doing a dpkg -l | wc -l and you'll get the idea. Even a default Debian system can have hundreds of libraries of dubious origins. Would I trust my important data to it? Definitely not. Don'

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Martin Braun
>> I used OpenBSD back in the 3.x days, > The last 3.x release was 8 years ago. > Are you fucking serious? Yup. >> but eventually began using Debian >> because it was much easier to maintain > Can you please give an example of a maintenance task > that is easier then the comparable/analogous ta

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Martin Braun
So you had a good time.. great! So I guess you're running a clean OpenBSD box without any kind of thirdparty application? In that case great.. otherwise go suck on a lollypop! 2014-04-04 12:18 GMT+02:00 Andy : > Hahahahahahahahahaha.. Reaallly!!! :) > > You should have sent this a couple of

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Martin Braun
No! By easier to maintain it means "apt-get update; apt-get dist-upgrade" which is freaking neat! You can say what you want about Debian, but their apt system is exceptional! Especially between versions. 2014-04-04 12:18 GMT+02:00 Tito Mari Francis Escaño < titomarifran...@gmail.com>: > By ea

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Stuart Henderson
On 2014-04-04, Kevin Chadwick wrote: > If a port is considered dangerous like wireshark was it > is removed to avoid encouraging it but users can still build it of > course. There's a problem with *not* having it in ports too, if people do compile it for themselves, considering ho

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread sven falempin
On Fri, Apr 4, 2014 at 1:15 PM, Aaron Poffenberger wrote: > On Apr 3, 2014, at 10:20 PM, Kenneth Westerback > wrote: > > > On 3 April 2014 22:04, Martin Braun wrote: > >> As we all know on the front page of OpenBSD it says "Only two remote > holes > >> in the default install, in a heck of a long

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Aaron Poffenberger
On Apr 3, 2014, at 10:20 PM, Kenneth Westerback wrote: > On 3 April 2014 22:04, Martin Braun wrote: >> As we all know on the front page of OpenBSD it says "Only two remote holes >> in the default install, in a heck of a long time". >> >> I don't understand why this is "such a big deal". >> >>

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Kim Zeitler
> All in all the default install is pretty useless in itself and I am going > to quote "Absolute OpenBSD" by Michael Lucas: > > «You're installed OpenBSD and rebooted into a bare-bones system. Of > course, a minimal Unix-like system is actually pretty boring. While it > makes a powerful foundat

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Chris Bennett
Static web pages?? Did you notice that sqlite3 is in base? So you could run your website off of a database, write your OWN software in perl, make highly interactive pages, view them in lynx, offer images to outside viewers browsers, etc. I'm using postgresql, but I could change over to all base

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Nick Holland
On 04/03/14 22:04, Martin Braun wrote: ... > Maybe I am just plain stupid, but could someone explain to me the point in > "bragging" about only two remote holes in the default install, when the > default install is useless before you add some content to the system, > unless you're running a web ser

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Kevin Chadwick
previously on this list Andy contributed: > OpenBSD is a learning curve but one which > will pay off if you persevere (especially if you're trying to use it for > network services). This is the best, perhaps only way to answer the question as there are many reasons mainly coming down to securit

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Tito Mari Francis Escaño
By easier to maintain, it means having regular task of patching the system here or there a.k.a. job security for system administrators :) On Fri, Apr 4, 2014 at 3:13 PM, Eric Furman wrote: > On Fri, Apr 4, 2014, at 01:47 AM, Martin Braun wrote: > > The particular issue didn't compromise the web

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Andy
Hahahahahahahahahaha.. Reaallly!!! :) You should have sent this a couple of days ago as an April fools, I genuinly thought it was at first. Anyway it seems like enough people have already replied so I won't add any more. Just had to reply because this geuninly made me laugh out loud. G

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread bofh
On Fri, Apr 4, 2014 at 3:13 AM, Eric Furman wrote: > On Fri, Apr 4, 2014, at 01:47 AM, Martin Braun wrote: > > I used OpenBSD back in the 3.x days, but eventually began using Debian > > because it was much easier to maintain - yes, I compromissed quality over > > convinience. > > Easier to mainta

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Eric Furman
On Fri, Apr 4, 2014, at 01:47 AM, Martin Braun wrote: > The particular issue didn't compromise the web server it only compromised > the web application, but yes that made me look deeper into operating > systems and security. I even tested FreeBSD Jails, but lets not go there. > > I used OpenBSD ba

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Jan Stary
On Apr 04 04:04:47, yellowgoldm...@gmail.com wrote: > As we all know on the front page of OpenBSD it says "Only two remote holes > in the default install, in a heck of a long time". > I don't understand why this is "such a big deal". Look at the history of other systems and their remote holes. Don

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Martin Braun
The particular issue didn't compromise the web server it only compromised the web application, but yes that made me look deeper into operating systems and security. I even tested FreeBSD Jails, but lets not go there. I used OpenBSD back in the 3.x days, but eventually began using Debian because it

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Emille Blanc
On 14-04-03 7:04 PM, Martin Braun wrote: As we all know on the front page of OpenBSD it says "Only two remote holes in the default install, in a heck of a long time". I don't understand why this is "such a big deal". Not 3 days ago, I isolated suspicious network activity to a "high-end" netw

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread bofh
On Fri, Apr 4, 2014 at 12:24 AM, Theo de Raadt wrote: > > On Thu, Apr 3, 2014 at 10:04 PM, Martin Braun >wrote: > > > > > As we all know on the front page of OpenBSD it says "Only two remote > holes > > > in the default install, in a heck of a long time". > > > > > > I don't understand why this i

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Theo de Raadt
> On Thu, Apr 3, 2014 at 10:04 PM, Martin Braun wrote: > > > As we all know on the front page of OpenBSD it says "Only two remote holes > > in the default install, in a heck of a long time". > > > > I don't understand why this is "such a big deal". > > > > Because their shit don't stink? Unlike

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Martin Brandenburg
Martin Braun wrote: > As we all know on the front page of OpenBSD it says "Only two remote holes > in the default install, in a heck of a long time". > > I don't understand why this is "such a big deal". > > A part from the base system in xBSD, OpenBSD - so far - also contains a > chrooted web

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread bofh
On Thu, Apr 3, 2014 at 10:04 PM, Martin Braun wrote: > As we all know on the front page of OpenBSD it says "Only two remote holes > in the default install, in a heck of a long time". > > I don't understand why this is "such a big deal". > Because their shit don't stink? Unlike other distribution

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Kenneth Westerback
On 3 April 2014 22:04, Martin Braun wrote: > As we all know on the front page of OpenBSD it says "Only two remote holes > in the default install, in a heck of a long time". > > I don't understand why this is "such a big deal". > > A part from the base system in xBSD, OpenBSD - so far - also contai

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Theo de Raadt
> So we need those third party applications to start the party, yet none of > these applications receives the same code audit, security development and > quality control as OpenBSD does. But unlike on other operating systems, those applications are ALWAYS compiled with PIE, and the stack protector

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Scott Learmonth
The statement holds true though (well, I trust it does, I can't verify). They're "bragging" about holes, or lack thereof, in their software, not third party software. It's a matter of personal preference how much needs to be added to a base install to make it good for your use. I use complete base