FreeBSD in the Office? Blue Sky Thinking! reddit / freebsd ---------------------------------------------------------------------- vermaden · 2022-05-07 09:05 I used to use FreeBSD on ThinkPad W530 at daily sysadmin work: [https://www.deviantart.com/vermaden/art/CorporateBSD-FreeBSD-at- Work-190680188](https://www.deviantart.com/vermaden/art/CorporateBSD- FreeBSD-at-Work-190680188) ​ ... but then the 'security clown circus team' grown too much in the wrong direction and made \*everyone\* happy with forcing Windows on the laptops ... for security reasons. ---------------------------------------------------------------------- kraileth · 2022-05-07 11:09 Ouch... That's quite a downgrade really! I've been using FreeBSD on both my workstation and laptop at work for several years now. The rest of the team is not exactly happy about it, but they've developed a "this is your problem" mentality and as long as I spend less time keeping my systems working than they do and everything we're required to do works, I don't see that change soon. I might agree to switch to Linux at work if someone could come up with very good reasons (so far for our use cases nobody did). But if I were to switch to Windows or get another job, I would seriously consider the latter. ---------------------------------------------------------------------- AntoineDarquier · 2022-05-07 19:53 He forgets to mention Gnumeric, Emacs Org Mode + LaTeX and AbiWord. Gnumeric is *very good* for spreadsheets, it is better than MS Excel in many areas. A few examples of the domains where it surpasses Excel: [https://www.larrygowdy.com/gnumericreview.html](https://www.larrygowd y.com/gnumericreview.html) [https://www.reddit.com/r/software/comments/nibavt/gnumeric\_is\_a\_fa ster\_foss\_alternative\_to\_excel\_i/Then](https://www.reddit.com/r/s oftware/comments/nibavt/gnumeric_is_a_faster_foss_alternative_to_excel _i/Then) [https://www.reddit.com/r/linux/comments/1l70in/my\_class\_is\_requiri ng\_excel\_with\_data\_analysis/cbwc2d4/?utm\_source=share&utm\_medium =web2x&context=3](https://www.reddit.com/r/linux/comments/1l70in/my_cl ass_is_requiring_excel_with_data_analysis/cbwc2d4/?utm_source=share&ut m_medium=web2x&context=3) [https://tech.slashdot.org/story/03/08/23/2138251/gnumeric-now- supports-all-excel-worksheet- functions](https://tech.slashdot.org/story/03/08/23/2138251/gnumeric- now-supports-all-excel-worksheet-functions) [https://www.generationamiga.com/2020/04/05/new-amigaos-release-of- gnumeric-crunches-numbers-like-a- pro/](https://www.generationamiga.com/2020/04/05/new-amigaos-release- of-gnumeric-crunches-numbers-like-a-pro/) [https://www.google.com/search?q=excel+security+issue&biw=1920&bih=980 &tbs=qdr%3Ay&ei=AFN1YpTrHY2zkwX41a3QCw&ved=0ahUKEwiU64jOq8v3AhWN2aQKHf hqC7oQ4dUDCA4&uact=5&oq=excel+security+issue&gs\_lcp=Cgdnd3Mtd2l6EAMyB AgAEB4yBggAEAgQHjIGCAAQCBAeOggIABAHEB4QEzoGCAAQBxAeOggIABAIEAcQHjoKCAA QCBAHEAoQHkoECEEYAUoECEYYAFDtBljhDWCoEGgBcAB4AIABW4gB2gKSAQE1mAEAoAEBw AEB&sclient=gws- ](https://www.google.com/search?q=excel+security+issue&biw=1920&bih=98 0&tbs=qdr%3Ay&ei=AFN1YpTrHY2zkwX41a3QCw&ved=0ahUKEwiU64jOq8v3AhWN2aQKH fhqC7oQ4dUDCA4&uact=5&oq=excel+security+issue&gs_lcp=Cgdnd3Mtd2l6EAMyB AgAEB4yBggAEAgQHjIGCAAQCBAeOggIABAHEB4QEzoGCAAQBxAeOggIABAIEAcQHjoKCAA QCBAHEAoQHkoECEEYAUoECEYYAFDtBljhDWCoEGgBcAB4AIABW4gB2gKSAQE1mAEAoAEBw AEB&sclient=gws-) ---------------------------------------------------------------------- Wasabimiester · 2022-05-07 23:18 Wow. 🙄 ---------------------------------------------------------------------- Wasabimiester · 2022-05-07 23:20 The only software engineers I have met who use Windows are .... the not especially good ones. And I have yet to find a system administrator who uses Windows (unless, of course, they have to administer Windows — in which case {Bill Clinton voice} "I feel yer pain") ---------------------------------------------------------------------- vermaden · 2022-05-07 23:39 I used to use FreeBSD on that laptop till very sad 'security' event on 2017. One of the guys was dumped from work for 'security issue' - that he used his personal drive for work purposes - but when he submitted a form to get a company drive for these purposes a month ago - it was refused. Real shitty stuff. This is more or less the time when I moved to the 'official' Winblows system. ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 09:05 > And I have yet to find a system administrator who uses Windows You can take me as such system administrator. Since ~ 2006 I use Windows on desktop/laptop, with ~1 year of Linux as primary desktop/laptop system. edit: I must say, that since 2016-2017, with start of WSL, things greatly improved for me, so see no point to change OS at all. Before using some tooling was a bit troublesome/required Linux VMs. ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 09:09 I can be totally wrong, but what options FreeBSD provides in Device Management and Policy Management? Things come to mind if I'd be from ITSec/CorpIT teams: * enforcing screenlocks for inactivity * enforcing disk encryption ( say on Windows it can be done in runtime, without reinstall) * enforcing system updates * disabling administrator level (root) permissions * .. so on On Windows/Mac, this is more or less answered questions, I'm not sure it's all that easy on FreeBSD. ---------------------------------------------------------------------- kraileth · 2022-05-08 15:39 Excellent question! Let's see: * FreeBSD's default shell (as of 13.x), tcsh, supports both locking and auto lockout. When working with X (which one probably wants on a workstation), it depends on the WM / DE and the preferences of the user. The locking tools like i3-lock are not in base but easily available from packages (the same goes for graphical environments, so that should be fine). * For full-disk-encryption there's two methods available: GELI and GDBE (the latter is even designed to save lives if e.g. you work in an embassy and are taken hostage...). Both require a choice at install time, unless you're fine with only encrypting partitions that you could wipe at least temporarily. If you're only concerned about user data and not the OS, you can use ZFS' native encryption e.g. for the home directories. This is even portable to other systems like Linux. * Would be as easy as setting up a cron job. Advanced options are possible like creating a new BE before each update and setting the "boot once" flag. So the auto update won't affect your user while still working and if the system fails to boot next time after a broken update, a second reboot will "fix" it for the moment. * This is the default. There's no *doas* or *sudo* in base (\*sigh\* though). And if you don't add the user to the *wheel* group, he or she will not be able to `su` to root - even if the root password is known. In the latter case, the competent user can of course login as root if he/she knows how to do that. It's probably possible to prevent local root access entirely by special means. But I'm not sure it makes a lot of sense. Plus I'm a skeptic regarding Windows and macOS. Sure, both seem to provide that functionality. But it's not auditable, you have to trust the words of the vendor. With open source solutions like FreeBSD, you don't. ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 15:48 In the world where time is infinite and free, bothering security team of tieing that points together [in secure way], creating agents and management dashboards/reporting [to keep overview over the fleet of user machines], just to let single user [with laptop/desktop] keep FreeBSD may exist. On practice, I doubt anyone has such nice conditions, at least I don't. ---------------------------------------------------------------------- kraileth · 2022-05-08 17:48 Well, as I said, I'm using it for work. I still agree with you, that it's extremely rare. I work for a company that does not make most of the money with off-the-shelf products but by tailoring solutions for our customers. To be able to do that you need staff that enjoys doing things that are not exactly mainstream. And those people are much more likely to have a strong preference for their OS of choice than most people have. Said company once tried to "consolidate" laptops and desktops - with CentOS 6 and KDE. It was... not the best idea. We lost one person who swears by Gentoo and more people loathed bloated KDE than people were ok with it. We returned to the "you do you" policy of free choice for the admins and I'm fairly sure that we have benefited greatly from that. If tomorrow I announced that I would rather use illumos, I would be required to do all the research in my free time and then prove that I can meet the requirements of all the policies that we have and can handle every task that I'm required to do. And this is why it works for us: It's not the security team who has to deal with selecting the right components and come up with solutions. It's me who wants to use an OS that is not quite the standard. They just have to put it to the test by e.g. me demonstrating that the SSH agent will clear the cache when the screen lock kicks in and such. Of course I documented things, so that if another co-worker would like to switch to FreeBSD (we had one who also used it, but unfortunately he moved out of the area). If I really wanted to switch to illumos or OpenBSD, I know perfectly well that I'd annoy several people. But it still is a possibility. ---------------------------------------------------------------------- Wasabimiester · 2022-05-08 18:26 I have not used Windows in several years, but I have been paying attention to that WSL. Could be a Linux desktop killer (tho likely not for me — after two years exclusively running Linux, I find it hard to imagine running anything else — aside from perhaps FreeBSD). I will say that not all versions of Windows are awful. Back in the day I had to use WindowsNT 3.51 and although it was as ugly as Window 3.1, that damned thing was ROCK solid. Impossible to crash. Probably the best OS Microsoft ever made (Windows 2000 being nearly tied). >with \~1 year of Linux as primary desktop/laptop system I am curious to hear you compare the two. ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 20:18 > I am curious to hear you compare the two. The phrase that I'm not looking back on changing OS should give indirect hint on how much I like it :) The best thing it had - instant terminal launch. I guess I miss this part only (but not THAT much). ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 20:21 > Could be a Linux desktop killer I consider anything in Linux as desktop/laptop beyond Chromebooks as unexistent en mass to take it into any serious account. ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 20:45 > Said company once tried to "consolidate" laptops and desktops - with CentOS 6 and KDE. It was... not the best idea. Linux on laptop/desktop..still not there by far - understandable. > If tomorrow I announced that I would rather use illumos, I would be required to do all the research in my free time and then prove that I can meet the requirements of all the policies that we have and can handle every task that I'm required to do. Even assuming you can do it and do it right - I honestly see it as very "pet" (in reverse to "cattle") and extraordinary case, nothing like something in normal and statistically out of interest. -- As practical exercise of pro and cons, you may try imagine passing PCI DSS audit and convincing auditors that _that_ machine is properly secured by yourself. Of course if you not pass it, your bank will rise questions of why they should keep letting you processing VISA/Mastercard and your business under real danger. -- I was trying to imagine that one of my colleagues started using [on work machine] say Illumos and says he cannot make tests with Docker- compose or Ansible anymore or needs one more week to finish setting up his env. Definitely will make me rise my brows for "WTF?!". ---------------------------------------------------------------------- Wasabimiester · 2022-05-08 20:51 I always hated CMD.EXE. What a pile of crap! ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 21:06 > What a pile of crap! While that's true, on practical side, was not any kind of issue for me and most of others - we just don't use it. ---------------------------------------------------------------------- Wasabimiester · 2022-05-08 21:17 I can understand what you are saying. I have different needs: I am a software engineer. So for me, Windows is just godawful. The lack of a terminal that works with all the tools I need (bash, Perl, sed, awk, emacs, vi, etc — right out of the box) and the damned OS phoning home to Redmond, etc. I just can't stomach it. Let's not even talk "security". 😞 macOS worked great for me for a long time (since it is under the hood \*BSD). But I don't like Apple's hostility toward right-to-repair, and I don't trust them to not rip me off at the "genius bar" when sh&t goes south. $12 part dies but "You need a new motherboard ..... that will be $1,200" So I opted for System76 two years ago when it was clearly time for a new laptop. It's not perfect, but it's pretty good. I simply don't like anything Microsoft makes (although VS Code is pretty good, and the Surface Pro is interesting). I will admit I could be ignorant on this front but after 20 years off-and-on dealing with various Microsoft products, I just have had enough. Visual SourceSafe was the clincher. Jeebus what a pile of garbage! And I don't understand why they have to bastardize C++. ---------------------------------------------------------------------- Wasabimiester · 2022-05-08 21:29 I completely understand. It's just different for me. If I don't have a decent terminal and shell, I feel like someone took my testicles away. 🤣 ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 21:31 > OS phoning home to Redmond I have no problem with that - on two of my laptops I have Windows Insider ( kinda Windows Beta/Preview program from MS ) with telemetry enabled. In general, I enable / opt-in in telemetry in software, i.e. Firefox - I have strong believe that product and engineering teams need valuable data on usage patterns, crashes and features in use to make _better_ product for me. I see it as wider case of some issue with server and remote party denying to provide any logs. ---------------------------------------------------------------------- Wasabimiester · 2022-05-08 21:34 > I have strong believe that product and engineering teams need valuable data on usage patterns, crashes and features in use to make > >better > > product for me. I do not disagree. I just prefer that it is entirely up to me to opt- in. ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 21:46 you may be interested to enrich your vision (not saying you MUST use it) to keep up with modern trends/view on how others doing it, just to ensure you are not in clam shell :) * https://www.youtube.com/watch?v=kC3eWRPzeWw - WSLg intro from Microsoft itself ~ 17 minutes * https://www.youtube.com/watch?v=oF6gLyhQDdw - around 15 minutes on general overview and setup from dev guy ---------------------------------------------------------------------- Wasabimiester · 2022-05-08 21:51 Saving this post, so thank you. ---------------------------------------------------------------------- kraileth · 2022-05-08 22:18 >Linux on laptop/desktop..still not there by far - understandable. And it was even less so back in the day, yes. Still it was seen as good enough - and to be fair: It mostly was. Also at that time we still had two or three people who actually used Windows on their machines. ​ >Even assuming you can do it and do it right - I honestly see it as very "pet" (in reverse to "cattle") and extraordinary case, nothing like something in normal and statistically out of interest. Oh, it is very much "pet", not just as the opposite to "cattle" in IT terms, but also because somebody likes one system more than "well, it's a tool like any other". We once almost got a deal where a large company was to bring 30+ Solaris-based machines over to us (things were almost worked out when their project manager changed and the new one didn't dare make the change). We got that far because we have people who know ZFS as well as the basics of tools like DTrace and even knew that SmartOS (target platform) exists and that it's a system designed to run from RAM after booting over PXE instead of a classically installed server OS. They were rather surprised one of us actually had heard of it when they mentioned it on the first meeting. There are scenarios where you can score with exotic skills. ​ >As practical exercise of pro and cons, you may try imagine passing PCI DSS audit and convincing auditors that that machine is properly secured by yourself. Of course if you not pass it, your bank will rise questions of why they should keep letting you processing VISA/Mastercard and your business under real danger. I do not know the specifics of that certification, but I'm involved with our certification efforts. And I must say that I'd be *very* surprised if a Solaris-based infrastructure would be deemed completely unacceptable in the first place. I've had to answer questions about our BSD-based machines in audits. My conclusion so far: Usually the auditors are not very familiar with it and once they get the feeling that we do know what we are doing, things are generally fine. ​ >I was trying to imagine that one of my colleagues started using \[on work machine\] say Illumos and says he cannot make tests with Docker- compose or Ansible anymore or needs one more week to finish setting up his env. Definitely will make me rise my brows for "WTF?!". Docker is mostly phased out tech right now and while I do see the point of being able to run it directly on your machine, I would simply do that remotely on a Linux server (until not that long ago that was what the Windows users had to do, too, right?). And ansible works on both \*BSD and illumos, of course. Also I don't see the problem with me talking to my colleagues tomorrow about planning to make the switch - and then to actually do it once I'm ready. It's not like I'm losing my current work env! ---------------------------------------------------------------------- CoolTheCold · 2022-05-08 22:39 > And I must say that I'd be very surprised if a Solaris-based infrastructure would be deemed completely unacceptable in the first place. If by "infrastructure" you mean servers, not laptop/desktop, then I agree and have no objections. But we started on using it as end user side and even not Solaris, but on FreeBSD. ---------------------------------------------------------------------- kraileth · 2022-05-09 05:14 If the base system (probably with some additional hardening) is acceptable for running mission-critical services on servers, it should also be fine as the foundation for a desktop that does not even expose any services. Additional software must be picked carefully but the same is true for the server. The most important difference IMO is that workstations are not running all the time and may be operated in a less secure environment compared to a data center. So encryption of data at rest is a rather important thing. The second one is screen locking, but we already covered that. Some people might be concerned about trusty old X, but wayland is an option on FreeBSD (and there's even a FreeBSD-first wayland WM). Desktop illumos is a bit more special admittedly and I don't feel competent enough to set up e.g. OI in a way that would meet the requirements. Could be an interesting challenge but I have no idea whether I'd succeed or not. With FreeBSD it's not that much of a problem. If a Linux desktop is acceptable, most of the same programs are available. And at least both platforms do not have the abysmal security record that Microsoft's OS has: even though gut instinct says that they have improved **much** in the last decade, it's known to have been a one-of-a-kind level disaster and still people are ok with just taking their word for it but make demands to the likes of FreeBSD? I've never understood that type of security thinking to be honest. ---------------------------------------------------------------------- CoolTheCold · 2022-05-09 13:43 > If a Linux desktop is acceptable That's a big IF to me. Very BIG IF. I was discussing state of things in Linux-as-End-User-Workstation world and covering it with policies with my ex-boss, who is CISO and we both agreed, that it's rudimentary (I'm not any kind of professional Security guy). A bit more on that: It's all started with - I've suddenly realized, that on work system, with ITSec/CORPIT approved distro (Fedora): * system updates were not forced - by that time it was running Fedora 33 when Fedora 35 was already shipped, tons of packages were not upgraded - GREAT DIFFERENCE from WSUS/ManageEngine centralized updates enforcement. * has no disk encryption and noone even pings me to bring system for resetup * has no local account password policy (for corporate services like VPN LDAP is used) both for expires and complexity * my local account is not tied to LDAP (not even mentioning god- blessed integration of AD in Windows) * I have root access and can install anything * firewall is not managed * and so on So, i've asked him - is my security team so bad or there is no good tooling, comparing to what is normal in corporate world for Windows/MacOS. His answer basically was "tooling sucks, myriad of distros and DEs doesn't help it at all too". > it should also be fine as the foundation for a desktop that does not even expose any services I suggest to stop further discussion, it goes nowhere as I see - end user machines are much more versatile in what can be running (we don't trust users to obey policy to not run any random shit from internet of course) and this, from my POV is clear and implied, but as you think this way, we definitely see situation in different angles. ---------------------------------------------------------------------- kraileth · 2022-05-10 05:23 >I suggest to stop further discussion, it goes nowhere as I see - end user machines are much more versatile in what can be running (we don't trust users to obey policy to not run any random shit from internet of course) and this, from my POV is clear and implied, but as you think this way, we definitely see situation in different angles. Agreed. We have quite different situations, too. My perspective is that of a small team where regarding LDAP I would even say: "Avoid like the plague!". But for a larger team the opposite is true of course. Also I'm talking the admins here - they totally need to be capable of not running random stuff from the net. If I cannot trust somebody to not paste one of those lines invoking curl to get a shell script and immediately pipe it to bash without knowing what it does, that somebody is useless for administration tasks. I would not advise to let people in accounting and such choose and manage their own OS. But the admins need to be capable of it - so why not let them?