A few questions about BSD reddit / BSD ---------------------------------------------------------------------- goshdingit · 2017-08-29 23:45 I've been considering trying out BSD but there are a few things that concerned me when reading about the OSes 1. I first looked at OpenBSD and saw that the packages don't get any updates, which is a major concern for me since I'll have packages full of security holes. Is that an issue with FreeBSD and NetBSD? Does FreeBSD and NetBSD patch and update their packages? 2. I read somewhere that FreeBSD has driver binary blobs in the kernel, I don't mean proprietary firmware which Linux and OpenBSD have but actual proprietary kernel modules. Is that true? ---------------------------------------------------------------------- LinusMasterBait · 2017-08-30 00:09 1. Both NetBSD and FreeBSD have their ports distribution on a quarterly release. However, FreeBSD provides a -latest release which would make it similar to a rolling release. It's also stable enough, although not by some standards. FreeBSD does update their packages on its stable releases though. Pkgsrc (netbsd) has a "current" release that's also constantly updated. However, OpenBSD provides one binary- based ports tree for every release. You would have to sync with their CVS head to get more recent packages, and I'm not sure they'd recommend this. You do get some updates for key packages though. 2. Where did you read this? I haven't heard anything about that and FreeBSD, even though it's not bound by the GPL to watch its licences, are very conservative about the licences in base. As are NetBSD and OpenBSD (especially OpenBSD). They wouldn't allow entire proprietary modules in it unless they were forced to and even that would probably be done through an optional module disabled by default. What you've probably heard is that they have "non-free" software in their base, non-free often stated as an umbrella term by the FSF folks for "not compatible with the GPL". ZFS is licensed under the CDDL, which isn't compatible with the GPL, and it's one of the two main filesystems in FreeBSD. It does respect the four rules of free software though (run, study, modify, redistribute). FreeBSD does contain firmware blobs though. But as a rule of thumb, any licence that's not compatible with the BSD 2-clause licence is avoided like the plague and isolated in contrib/, gnu/ or cddl/. ---------------------------------------------------------------------- goshdingit · 2017-08-30 00:21 Hi thanks for clarifying about the packages. I'll probably go for FreeBSD since that has package updates on their stable release. Now as for the binary blobs I've read about FreeBSD having binary blobs in this rather old mailing list email: https://lists.freebsd.org/pipermail/freebsd- questions/2006-October/134041.html and this manpage: http://www.unix.com/man-page/freebsd/4/hptmv/ ---------------------------------------------------------------------- Nanosleep · 2017-08-30 01:19 To the best of my knowledge, packages for OpenBSD's stable release *will* get updates, but only security updates/backports if needed. Otherwise they'll stay the same major and minor version they were when they were first introduced, at least until the next release (which is always, at most, 6 months away). OpenBSD definitely does update the stable release, look at `syspatch` and `pkg_add -u`. That said, if you want bleeding edge packages, that's not a problem either. Run snapshots, use ports snapshots, and ports-wip. ---------------------------------------------------------------------- icantthinkofone · 2017-08-30 01:32 Those are things that *can* be compiled into the kernel but they are *not* provided that way. You *must* build the kernel from source to include them. Being device drivers, there are advantages to having them there but they are not part of any build. ---------------------------------------------------------------------- goshdingit · 2017-08-30 01:32 Do you know if Firefox gets security updates on OpenBSD? That's one package I'm particularly concerned about since web browsers are high risk when it comes to security. ---------------------------------------------------------------------- Nanosleep · 2017-08-30 01:33 [You tell me](http://openports.se/www/mozilla-firefox) ---------------------------------------------------------------------- calrogman · 2017-08-30 02:32 >Note that binary packages for -release and -stable are not updated. - https://www.openbsd.org/faq/faq15.html#PortsSecurity ---------------------------------------------------------------------- calrogman · 2017-08-30 02:33 No, like any other package, the firefox package won't be changed after release. Fortunately, the maintainer of the firefox port provides updated packages [here.](https://packages.rhaalovely.net/) You can simply copy https://packages.rhaalovely.net/landry-mozilla- pkg.pub into `/etc/signify` and do `PKG_PATH=packages.rhaalovely.net:installpath pkg_add -u firefox` ---------------------------------------------------------------------- northrupthebandgeek · 2017-08-30 06:10 OpenBSD packages don't receive security updates, but the underlying ports do in the -stable branch. Not ideal (since you'd need to manage a ports tree, which is not usually recommended for inexperienced users), but certainly still possible if you do want to pull in security fixes. OpenBSD's -CURRENT branch provides binary snapshots of both the base system (including install media) and ports/packages, though, so if you want to be on the bleeding edge of security fixes/enhancements (and features in general), it might be worth looking into just using -CURRENT. I've never heard of FreeBSD shipping with actual non-free drivers. I do know that FreeBSD is (last I checked) the only BSD supported by Nvidia's proprietary graphics drivers, but that's about it. ---------------------------------------------------------------------- SirRenaultMegane · 2017-09-12 18:09 Thanks! I just went from firefox 52 to 55, can feel the security flowing through me already. Do you by any chance know if any other maintainers are doing the same? Maybe a repo with a collection of newer packages could be made...