Re: Only two holes in a heck of a long time, but why?

2014-04-08 Thread Stuart Henderson
On 2014-04-07, Kevin Chadwick ma1l1i...@yahoo.co.uk wrote: previously on this list Stuart Henderson contributed: If a port is considered dangerous like wireshark was it is removed to avoid encouraging it but users can still build it of course. There's a problem with

Re: Only two holes in a heck of a long time, but why?

2014-04-08 Thread Mihai Popescu
So, Martin, what is your point ?

Re: Only two holes in a heck of a long time, but why?

2014-04-07 Thread Chris Bennett
On Sun, Apr 06, 2014 at 03:38:17PM -0700, Chris Cappuccio wrote: Chris Bennett [chrisbenn...@bennettconstruction.us] wrote: X is also built in. Gee, base is so insecure!! X is a security disaster Most of the internet sites I use work just fine with lynx. vi works ok. I use some

Re: Only two holes in a heck of a long time, but why?

2014-04-07 Thread Kevin Chadwick
previously on this list Stuart Henderson contributed: If a port is considered dangerous like wireshark was it is removed to avoid encouraging it but users can still build it of course. There's a problem with *not* having it in ports too, if people do compile it for

Re: Only two holes in a heck of a long time, but why?

2014-04-07 Thread Kevin Chadwick
previously on this list Riccardo Mottola contributed: Yes, sysmerge is really neat. Perhaps I should expand as to why if it has been so long without him using. sysmerge handles everything in /etc! via etc??.tgz and xetc??.tgz and lets you do quick diffs (which I shamelessly copied from for my

Re: Only two holes in a heck of a long time, but why?

2014-04-07 Thread Alexander Hall
On August 27, 2014 10:16:21 PM CEST, Kevin Chadwick ma1l1i...@yahoo.co.uk wrote: ... Kevin, FYI, your time is horribly off...

Re: Only two holes in a heck of a long time, but why?

2014-04-06 Thread Chris Cappuccio
Chris Bennett [chrisbenn...@bennettconstruction.us] wrote: X is also built in. Gee, base is so insecure!! X is a security disaster

Re: Only two holes in a heck of a long time, but why?

2014-04-06 Thread staticsafe
On 4/6/2014 18:38, Chris Cappuccio wrote: Chris Bennett [chrisbenn...@bennettconstruction.us] wrote: X is also built in. Gee, base is so insecure!! X is a security disaster

Re: Only two holes in a heck of a long time, but why?

2014-04-06 Thread sven falempin
On Sun, Apr 6, 2014 at 7:00 PM, staticsafe m...@staticsafe.ca wrote: On 4/6/2014 18:38, Chris Cappuccio wrote: Chris Bennett [chrisbenn...@bennettconstruction.us] wrote: X is also built in. Gee, base is so insecure!! X is a security disaster X is the worst form of windowing

Re: Only two holes in a heck of a long time, but why?

2014-04-05 Thread Jan Stary
On Apr 05 00:06:56, yellowgoldm...@gmail.com wrote: but eventually began using Debian because it was much easier to maintain Can you please give an example of a maintenance task that is easier then the comparable/analogous task in OpenBSD?

Re: Only two holes in a heck of a long time, but why?

2014-04-05 Thread Riccardo Mottola
Hi, Can you please give an example of a maintenance task that is easier then the comparable/analogous task in OpenBSD? ^ Because I remember Debian kinda sucked when I used it in 1998. apt-get update; apt-get dist-upgrade between

Re: Only two holes in a heck of a long time, but why?

2014-04-05 Thread Riccardo Mottola
Hi, Martin Braun wrote: By easier to maintain it means apt-get update; apt-get dist-upgrade which is freaking neat! You can say what you want about Debian, but their apt system is exceptional! Especially between versions. it is getting a bit off-topic, but yes... I stand to that. I tinker with

Re: Only two holes in a heck of a long time, but why?

2014-04-05 Thread Predrag Punosevac
On 04/03/14 22:04, Martin Braun wrote: ... Maybe I am just plain stupid, but could someone explain to me the point in bragging about only two remote holes in the default install, when the default install is useless before you add some content to the system, unless you're running a web server

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Jan Stary
On Apr 04 04:04:47, yellowgoldm...@gmail.com wrote: As we all know on the front page of OpenBSD it says Only two remote holes in the default install, in a heck of a long time. I don't understand why this is such a big deal. Look at the history of other systems and their remote holes. Don't you

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Eric Furman
On Fri, Apr 4, 2014, at 01:47 AM, Martin Braun wrote: The particular issue didn't compromise the web server it only compromised the web application, but yes that made me look deeper into operating systems and security. I even tested FreeBSD Jails, but lets not go there. I used OpenBSD back

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread bofh
On Fri, Apr 4, 2014 at 3:13 AM, Eric Furman ericfur...@fastmail.net wrote: On Fri, Apr 4, 2014, at 01:47 AM, Martin Braun wrote: I used OpenBSD back in the 3.x days, but eventually began using Debian because it was much easier to maintain - yes, I compromissed quality over convinience.

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Andy
Hahahahahahahahahaha.. Reaallly!!! :) You should have sent this a couple of days ago as an April fools, I genuinly thought it was at first. Anyway it seems like enough people have already replied so I won't add any more. Just had to reply because this geuninly made me laugh out loud.

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Tito Mari Francis Escaño
By easier to maintain, it means having regular task of patching the system here or there a.k.a. job security for system administrators :) On Fri, Apr 4, 2014 at 3:13 PM, Eric Furman ericfur...@fastmail.net wrote: On Fri, Apr 4, 2014, at 01:47 AM, Martin Braun wrote: The particular issue

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Kevin Chadwick
previously on this list Andy contributed: OpenBSD is a learning curve but one which will pay off if you persevere (especially if you're trying to use it for network services). This is the best, perhaps only way to answer the question as there are many reasons mainly coming down to security

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Nick Holland
On 04/03/14 22:04, Martin Braun wrote: ... Maybe I am just plain stupid, but could someone explain to me the point in bragging about only two remote holes in the default install, when the default install is useless before you add some content to the system, unless you're running a web server

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Chris Bennett
Static web pages?? Did you notice that sqlite3 is in base? So you could run your website off of a database, write your OWN software in perl, make highly interactive pages, view them in lynx, offer images to outside viewers browsers, etc. I'm using postgresql, but I could change over to all base

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Kim Zeitler
All in all the default install is pretty useless in itself and I am going to quote Absolute OpenBSD by Michael Lucas: «You're installed OpenBSD and rebooted into a bare-bones system. Of course, a minimal Unix-like system is actually pretty boring. While it makes a powerful foundation, it

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Aaron Poffenberger
On Apr 3, 2014, at 10:20 PM, Kenneth Westerback kwesterb...@gmail.com wrote: On 3 April 2014 22:04, Martin Braun yellowgoldm...@gmail.com wrote: As we all know on the front page of OpenBSD it says Only two remote holes in the default install, in a heck of a long time. I don't understand why

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread sven falempin
On Fri, Apr 4, 2014 at 1:15 PM, Aaron Poffenberger a...@hypernote.comwrote: On Apr 3, 2014, at 10:20 PM, Kenneth Westerback kwesterb...@gmail.com wrote: On 3 April 2014 22:04, Martin Braun yellowgoldm...@gmail.com wrote: As we all know on the front page of OpenBSD it says Only two remote

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Stuart Henderson
On 2014-04-04, Kevin Chadwick ma1l1i...@yahoo.co.uk wrote: If a port is considered dangerous like wireshark was it is removed to avoid encouraging it but users can still build it of course. There's a problem with *not* having it in ports too, if people do compile it for

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Martin Braun
No! By easier to maintain it means apt-get update; apt-get dist-upgrade which is freaking neat! You can say what you want about Debian, but their apt system is exceptional! Especially between versions. 2014-04-04 12:18 GMT+02:00 Tito Mari Francis Escaño titomarifran...@gmail.com: By easier

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Martin Braun
So you had a good time.. great! So I guess you're running a clean OpenBSD box without any kind of thirdparty application? In that case great.. otherwise go suck on a lollypop! 2014-04-04 12:18 GMT+02:00 Andy a...@brandwatch.com: Hahahahahahahahahaha.. Reaallly!!! :) You should have sent

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Martin Braun
I used OpenBSD back in the 3.x days, The last 3.x release was 8 years ago. Are you fucking serious? Yup. but eventually began using Debian because it was much easier to maintain Can you please give an example of a maintenance task that is easier then the comparable/analogous task in

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread ag@gmail
apt-get though seemingly simple, brings in shit load of libraries with names resembling alien species. Try doing a dpkg -l | wc -l and you'll get the idea. Even a default Debian system can have hundreds of libraries of dubious origins. Would I trust my important data to it? Definitely not.

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Thomas Pfaff
No! By easier to maintain it means apt-get update; apt-get dist-upgrade which is freaking neat! You can say what you want about Debian, but their apt system is exceptional! Especially between versions. Yes, truly exceptional. I had a blast upgrading from Sheesh to Whoosy, or whatever

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread John D. Verne
On Apr 4, 2014, at 18:06, Martin Braun yellowgoldm...@gmail.com wrote: I used OpenBSD back in the 3.x days, The last 3.x release was 8 years ago. Are you fucking serious? Yup. but eventually began using Debian because it was much easier to maintain Can you please give an example of

Re: Only two holes in a heck of a long time, but why?

2014-04-04 Thread Juan Francisco Cantero Hurtado
On Fri, Apr 04, 2014 at 07:48:50PM -0400, John D. Verne wrote: On Apr 4, 2014, at 18:06, Martin Braun yellowgoldm...@gmail.com wrote: I used OpenBSD back in the 3.x days, The last 3.x release was 8 years ago. Are you fucking serious? Yup. but eventually began using Debian

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Scott Learmonth
The statement holds true though (well, I trust it does, I can't verify). They're bragging about holes, or lack thereof, in their software, not third party software. It's a matter of personal preference how much needs to be added to a base install to make it good for your use. I use complete base

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Theo de Raadt
So we need those third party applications to start the party, yet none of these applications receives the same code audit, security development and quality control as OpenBSD does. But unlike on other operating systems, those applications are ALWAYS compiled with PIE, and the stack protector

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Kenneth Westerback
On 3 April 2014 22:04, Martin Braun yellowgoldm...@gmail.com wrote: As we all know on the front page of OpenBSD it says Only two remote holes in the default install, in a heck of a long time. I don't understand why this is such a big deal. A part from the base system in xBSD, OpenBSD - so

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread bofh
On Thu, Apr 3, 2014 at 10:04 PM, Martin Braun yellowgoldm...@gmail.comwrote: As we all know on the front page of OpenBSD it says Only two remote holes in the default install, in a heck of a long time. I don't understand why this is such a big deal. Because their shit don't stink? Unlike

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Martin Brandenburg
Martin Braun yellowgoldm...@gmail.com wrote: As we all know on the front page of OpenBSD it says Only two remote holes in the default install, in a heck of a long time. I don't understand why this is such a big deal. A part from the base system in xBSD, OpenBSD - so far - also contains a

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Theo de Raadt
On Thu, Apr 3, 2014 at 10:04 PM, Martin Braun yellowgoldm...@gmail.comwrote: As we all know on the front page of OpenBSD it says Only two remote holes in the default install, in a heck of a long time. I don't understand why this is such a big deal. Because their shit don't stink?

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread bofh
On Fri, Apr 4, 2014 at 12:24 AM, Theo de Raadt dera...@cvs.openbsd.orgwrote: On Thu, Apr 3, 2014 at 10:04 PM, Martin Braun yellowgoldm...@gmail.com wrote: As we all know on the front page of OpenBSD it says Only two remote holes in the default install, in a heck of a long time.

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Emille Blanc
On 14-04-03 7:04 PM, Martin Braun wrote: As we all know on the front page of OpenBSD it says Only two remote holes in the default install, in a heck of a long time. I don't understand why this is such a big deal. anecdote Not 3 days ago, I isolated suspicious network activity to a high-end

Re: Only two holes in a heck of a long time, but why?

2014-04-03 Thread Martin Braun
The particular issue didn't compromise the web server it only compromised the web application, but yes that made me look deeper into operating systems and security. I even tested FreeBSD Jails, but lets not go there. I used OpenBSD back in the 3.x days, but eventually began using Debian because