OPNsense and HardenedBSD are parting ways reddit / BSD ---------------------------------------------------------------------- [deleted] · 2021-04-22 16:19 [deleted] ---------------------------------------------------------------------- flatland_spider · 2021-04-22 18:11 There was SecurityRouter to fill that niche. :( https://securityrouter.org/wiki/Main_Page I wonder if Halon Security could be persuaded to opensource things? ---------------------------------------------------------------------- Xerxero · 2021-04-22 19:03 FreeBSD has put some effort again in the WiFi stack. At least there is one guy working on it. ---------------------------------------------------------------------- ScratchinCommander · 2021-04-22 20:11 That'd be awesome ---------------------------------------------------------------------- castillar · 2021-04-23 01:15 It’s a good suggestion (really I’d love to see it!), but I suspect the effort to convert from HardenedBSD back to vanilla FreeBSD is smaller than converting the system to OpenBSD. ---------------------------------------------------------------------- kraileth · 2021-04-23 04:36 While I understand the goal and think that it's reasonable, this is *very* unfortunate. Vanilla FreeBSD does have a history of neglecting even basic security features as proper ASLR (and I say that as someone who uses FreeBSD for everything including his laptops and workstations). This might also mean losing the ability to use the LibreSSL-based firmware, I guess? I've always seen HardenedBSD as a project to move FreeBSD in the right direction. To be able to do that however, it needs all the support that it can get. OPNsense rebasing on vanilla FreeBSD is entirely the wrong signal as it hints that FreeBSD was doing "well enough" and doesn't need to care for HardenedBSD. Since some comments here have brought up rebasing on OpenBSD instead: Thinking about security only, this might look tempting. However it would neither be practical (the OS is very much different from FreeBSD / HardenedBSD) nor would it make sense: OpenBSD is not at all optimized for performance whereas FreeBSD is. The OpenBSD guys are working on improving the situation and it's not unbearably bad - but it doesn't compare well with systems geared towards performance. I support the OPNsense project and while I do not approve of this particular decision, I'm trying to be positive about it. With the stated goal to be closer to mainline FreeBSD, I hope this means that over time OPNsense could lose some of the quirks it inherited from pfSense which sets it apart from the FreeBSD way of doing things (e.g. system startup). If some effort is put into this (and hey, we're an open source proJect!), it might be easier in the future to add back a HardenedBSD-based version. Would anybody else be interested in this? Or are there people here who don't want to lose their hardened router OS and would appreciate a series of tutorials for installing and configuring a router with HardenedBSD (but without the GUI)? ---------------------------------------------------------------------- trasz · 2021-04-23 11:08 OpenBSD’s pf isn’t really more modern - basically at some point development has split, and so the FreeBSD one actually scales. ---------------------------------------------------------------------- daemonpenguin · 2021-04-23 15:43 In short: no. If you read the announcement the post makes it clear OPNsense is more interested in improving support and making FreeBSD features work than specifically focusing on security. That is why they are moving away from HardenedBSD and toward FreeBSD. Switching to OpenBSD would take them much further away from their desired goal of being compatible with FreeBSD. ---------------------------------------------------------------------- capsevilla · 2021-04-26 09:50 Personally I wouldn't trust FreeBSD or HardenedBSD for mission critical security. There are just too many past issues and problems with the community when it comes to code quality, engineering choices, etc. HardenedBSD is just compiler flags and superficial hardening, it has no real world testing if the mitigations and compile flags are actually doing anything. Not saying FreeBSD cant provide great network performance and stability, scalability. I think if you are worried about a physical machine being exploited remotely OpenBSD or a highly specialized Linux build is the way to go. The only difference is one is ready to go out of the box and the other requires intense customization and experience. One mistake could compromise a network. However this is just my personal take. If you listen to some of the links I post you might wonder if there are no real easy solutions to computer security. Maybe its better to just be a little paranoid. Context: https://youtu.be/3E9ga-CylWQ https://youtu.be/7kShjboN6ek https://youtu.be/WwCZuN4qQPI Highly specialized Linux build https://www.ssi.gouv.fr/en/actualite/clip-os-open-source-secured- operating-system/