I really wanted to put OpenBSD on this old X1 Carbon 1st gen I had. I had trouble getting the installation with full-disk encryption working. The peeps in #openbsd/freenode were amazingly helpful, but after a lot of debugging we came down to "Is your hardware working correctly? Have you tried to install anything else?"
I ended up putting FreeBSD on it and it worked great for a while. Then came the reboots, the lockups ... turns out I really should have run memtest86 first. The memory was bad; probably several other things too. I purchased it from a dodgy used shop and didn't realize all of this until past the 30 days. The memory on those models are soldered in too. I ended up eBaying it as a parts laptop.
Supposedly a fully functional X1 1st gen runs OpenBSD great. :-P
I struggled a while back trying to get FDE on an OpenBSD install, and I think I did eventually get it working, although it took a good amount of time and effort. For comparison, back when I installed Arch with FDE for the first time, I found the documentation to be more than sufficient for getting it working relatively easily. Given OpenBSD's emphasis on security and the fact that the installer already can autopartition the hard drive its installing to, it would be awesome if the installer supported FDE in the installation without needing to manually deal with all the disk commands.
> and then it takes a bit of demonstrating that yes, the graphics runs with the best available resolution the hardware can offer, the wireless network is functional, suspend and resume does work, and so forth.
But then from the Gist the author linked wrt getting X working with HiDPI:
> I'm using X in full resolution of 2560x1440 with wsfb (backed by efifb(4)). I configured my X session for HiDPI (retina), so I had to calculate and set DisplaySize in xorg.conf to get the correct DPI. With my configuration below, most but not all fonts display correctly. A few widgets still have tiny fonts.
And later in that same Gist:
> I'm using Window Maker (since about 1997). It doesn't fully support HiDPI but it is possible to make it useable by tweaking the fonts. Some widgets are still tiny but window titles, menus etc. work fine.
So to fill in what comes after the ellipses for the typical respondent of news of a laptop running OpenBSD: "Really? But... wouldn't that require special trips to the internet to copy/paste configuration settings that still only partially solve the problem of a laptop running an OS that wasn't designed to run on a laptop?" And the answer seems to be: yes.
One more bullet point from that Gist:
> In /etc/sysctl.conf I have to disable suspend when the lid is closed: machdep.lidsuspend=0
But the blog author says suspend/resume does indeed work. Is the blog author manually suspending/resuming, or did he get it to trigger correctly when the lid is open/closed?
>So to fill in what comes after the ellipses for the typical respondent of news of a laptop running OpenBSD: "Really? But... wouldn't that require special trips to the internet to copy/paste configuration settings that still only partially solve the problem of a laptop running an OS that wasn't designed to run on a laptop?" And the answer seems to be: yes
These problems seem related to the choice of WindowMaker, not OpenBSD. Choosing a different window manager or desktop environment won't have the same issues.
And ACPI events vary wildly, unless the two people are using the exact same model I wouldn't be surprised if their suspend/resume success is different.
I noticed this with my new XPS laptop last year. After moving to GNOME, things started Just Working. A lot of what we consider basic functionality is implemented differently by each DE, and running in userspace, or is completely absent (like power management or automatic/easy wireless networking).
In my experience HiDPI is pretty well supported in Linux these days but mixed DPI over multiple monitors is still somewhat hit-and-miss. I've resorted to running my XPS 15's built-in screen at 1080P when I have my 1080P external monitors connected. Shame as I did pay extra for the 4K option!
Independent scaling per monitor is supposedly supported in Wayland and just around the corner in KDE so I live in hope. I hear it's mostly working in the very latest versions of Gnome now at least, although I couldn't get it to work.
(I appreciate that this is a thread about BSD - I'm just pointing out that the situation in Linux isn't much better)
I generally agree and also have an XPS but one extremely annoying thing is switching the screen scaling. I usually am using external monitors but if I want to use the built-in screen I have to change a few settings and restart half my applications.
OpenBSD's WiFi support is still the deal breaker keeping me from trying it out. Per iwm's documentation [0], 802.11n only partially works (no 40MHz channels, and limited to 1x1), and 802.11ac doesnt work at all. That means a max link rate of 72Mbps, and a real world speed of maybe half that.
I can saturate my 100Mb/s internet connection on Wifi so you'd be missing out on 2/3 of the speed there. It's useful for backups to be able to do even more than that as the local network is even faster. But you can probably get away with just ~30Mbps for most uses.
Yeah, I have FreeBSD on my laptop with iwm(4) also. 11a speeds are enough for the usual web surfing and stuff. When I need the speed (system upgrades mostly) I just plug in the cable. I have link aggregation set up with wifi and ethernet so the handover is seamless.
I'm very happy with my decision to not provide wired network all over my house after I moved. Good Wifi is really nice in that it decouples speed from location.
Even with 802.11ad (that I don't have) there's a huge difference between having to plug in when you reach a "fast area" and not having to.
Going wired->wifi is like going desktop->laptop. I'll admit to being slow to go to both laptop and wifi years ago, but at least to me they're clearly superior.
That used to be my solution in the b/g times. These days it has gotten to the point that unless I'm doing something extremely heavy like transfer TBs between machines the added advantage of not having to bother with a fixed location for the laptop and extra wiring compensates for the slower speed. And that's with simple wifi setups with a single good AP. I'm sure the line is even further pushed out if you've designed a multiple AP setup with good coverage and low interference.
I bought a Ubiquiti UAP-Pro access point. It is maginally faster than the fastest consumer access point / router, but substantially cheaper and more reliable.
The ubquiti has a spectrum survey mode that will tell you what sort of interference it sees on each channel. It takes 10's of minutes to run, and seems pretty thorough.
The real winning feature is that it is designed to be ceiling mounted, so I could place it in the center of my house, a few feet away from the nearest wall. There is also a mesh mode, where you buy more than one. If your house is big, and interference isn't the problem, that might help. I haven't tried it. They have newer / different models that do a better job of this than the UAP-Pro.
Later, I replaced my router with a pc engines apu2 running openbsd. Ubiquiti has a highly recommended cheap router (edgerouter lite) that works out of the box, if you aren't looking for a hobby project. People have gotten openbsd to run on it too.
Could you share your configuration for link aggregation? I did it for a while but if I remember correctly, while plugging the cable into my laptop worked as expected I think that in order to get connected to wifi again after unplugging the cable, I had to manually
service restart netif lagg0
And sometimes also
service restart dhclient lagg0
But it might also be that I was to impatient and that it would have reconnected to wifi by itself if I gave it more time. How long does yours take to get back on wifi?
That's like, your opinion man. With 802.11ac on 5GHz, on a mac laptop, I consistently get about 800-1100Mbps. That is gigabit speed. And it's everywhere in the house and yard because I have the appropriate number of APs configured with the right signal power and antenna gain. I have no need for cables anymore on my laptops in any situation where I need speed, and there are many such situations. All my files at home are on a network share. No problem, wifi is fast.
I feel people have only used badly configured crappy consumer APs on crappy laptops (without MIMO) and don't understand that wifi doesn't have to be slow and unreliable.
72 MB, which isn't the real world speed, as stated, isn't a lot. Thats only 9 actual megabytes a second. Now download any sizable source code project, or, upload many small changes. Or, even just a movie from itunes or something.
Good routers can go over 100Mbps, easily, and I would never think that 'less' speed is 'okay' in a world where increased speeds are just a requirement of technology over time, and usage, of said technology.
When I can, I use a cable (and an adapter so I can use Ethernet with my MBP). I've achieved up to 100Mbps on Wi-Fi at home but the problem has always been variable latency. Any kind of interfere from the dozens of other Wi-Fi networks in the area seems to have an effect, so I always plug in if I can.
i'm interested in your setup. are you using macos or another bsd? what kind of ap's do you use? what does your mesh look like? special antennas? thank you.
My setup is actually very simple. Actually I have several setups in multiple locations. I use Mikrotik[1] APs managed by Mikrotik controller (so centralized management for all APs). Look for the ones that support dual-concurrent tripple-chain 802.11ac like hAP ac or wAP ac. I use 5GHz everywhere although I do have 2.4GHz also. There is no interference on the 5GHz band as it doesn't penetrate walls (YMMV). I use a lot of APs, usually one AP per room if I want 5GHz coverage in that room.
The power used is very low. More power just means more interference. The bottleneck is the transmit power on the client, which is very low. More power on the AP just make everything louder. I've set up power level based on this document: https://support.apple.com/en-us/HT203068. Unfortunately only Apple documents this stuff, but works pretty well for everything AFAICT.
I don't have any special antennas. If you need to cover a large space with a single AP you might need one, but the best philosophy on 5GHz is to have many smaller APs.
All my APs are connected through ethernet (actually everything is PoE powered). I don't use any mesh stuff (although Mikrotik can be used in that configuration, I don't recommend it). All my APs are simple bridges, I don't use the Mikrotik tunnel stuff.
I don't use 802.11r because Mikrotik can't do it yet. I am not sure if anyone except Cisco can do it. I wish I had 802.11r, this is my Achilles' heel.
Everything works very well, but you get what you pay for. Mikrotik is really cheap compared to the real stuff out there, which means much less polish, more bugs, and no real documentation. If I were to do it again I might chose Unifi[2] instead. Don't get me wrong, this all works very well, but the level of polish is what you'd expect out of a GitHub project compared to some real commercial product. For example while you can set antenna gain in standalone AP mode, you can't do it in managed AP mode. Minor stuff like that.
I also run a RADIUS server and I create user accounts for all my wireless users (WPA2 Enterprise). At different locations users have the same credentials.
I use all kinds of clients (Linux/BSD/macOS), but the ones where I'm most interested in speed are the Macbooks.
I am running virtual machines with iSCSI storage over 802.11an... It's fast enough even for that. (Well, there's latency, but good enough for my development boxes.)
802.11n/802.11ac is a lot more complex then previous standards, and unlike Linux, OpenBSD has a single-digit number of developers working on drivers. If you've followed the past year or so, Intel wireless support is materializing.. we gained iwm(4), 802.11n in 6.0, MIMO (MCS 0-15) in 6.1. All in addition to new hardware support, fixes for quirky firmware bugs.
Not every project has engineers from Intel with internal datasheets, this came up before with USB 3.0 xHCI, which had Linux drivers long before the specs were public. There weren't even devices on the market!
Just installed OpenBSD 6.1 on an old Lenovo Thinkpad T500, and everything works. Suspend/Resume when closed/opened, Intel wireless card, wired ethernet port, sound, trackpad, function keys for adjusting screen brightness, all work. Well, the fingerprint reader won't work, actually, but that's about it.
Would definitely recommend this setup for folks not needing anything fancy (not for gaming/3d apps), but for your average web developer, it'll do the trick.
The caveat is that a T500 isn't exactly "modern" (c. 2006), but it's got a Core 2 Duo @ 2Ghz and 8G of ram, which is plenty for my admittedly modest needs.
Echo this; I was using an X201s with a bunch of OS's
Linux has the mess of NetworkManager
FreeBSD idled hard and also has wifi-supplicant and crap.
Solaris is a dead end and you can forget wifi.
OpenBSD was perfect, it felt so cleanly engineered with wifi/wpa handled by ifconfig.
the only concern was the bluetooth- they do not support, in any form, bluetooth. Because: "We have never seen a clean implementation of bluetooth". And yes, they trail with wifi support, but on a 7 year old laptop, that's fine.
That's easy for joining random hotspots, yeah. But for a more stable setup, wpa_supplicant is excellent. I have a config that prefers my home network (which is EAP-TLS secured, how does ifconfig on OpenBSD handle that?), then mobile hotspot, then a couple other known networks. It automatically decides the best network to use.
That is indeed cool, I used to rely on my bash history to find my old ifconfigs for common networks I liked. It's lower power though. Due to lack of polling.
I guess there are advantages to the wpa_supplicant way of doing things too. But you have the option on openbsd too at least.
Thinkpads are a nice fit for OpenBSD if they are not too recent.
Somehow, OpenBSD on a 2012 x220 has all the energy saving features, suspend abilities, media buttons actions, etc you could hope for in the base system, without a full desktop environment.
I find this simplicity quite relaxing compared to linux, where you would have to install either a full DE or a bunch of not-so-well-integrated softwares (acpid, tlp, powertop, ...) to have your machine just-working with a simple terms+browser+tilingwm setup.
On the other hand, browser performance is not as great, virtualization, docker, USB automount and wifi roaming aren't really there. It doesn't make a difference for me though.
What about mounting devices that use common filesystems? This is probably one of my biggest gripes with obsd. Mounting a regular msdos for read/write ought to work, but many times it just doesn't. There's no ext4 read/write support at all, etc.
If I knew anything about filesystems at all I think I'd volunteer to get it done, it seems like a pressing issue that nobody seems to care about much. I'd rather be able to mount as many things as GNU/Linux can before even thinking about USB automount...
Unlike some other operating systems, OpenBSD encourages users to split their disk into a number of partitions, rather than just one or two large ones. Some of the reasons for doing so are:
Security:
Some of OpenBSD's default security features rely on filesystem mount(8) options such as nosuid, nodev, noexec or wxallowed.
Stability:
A user or a misbehaved program can fill a filesystem with garbage if they have write permissions for it. Your critical programs, which hopefully run on a different filesystem, do not get interrupted.
Integrity:
If one filesystem is corrupted for some reason, then your other filesystems are most likely still OK.
fsck(8):
You can mount partitions that you never or rarely need to write to as readonly most of the time, which will eliminate the need for a filesystem check after a crash or power interruption.
That's fine with soft partitions like ZFS datasets, HAMMER pseudofilesystems or btrfs subvolumes. But OpenBSD doesn't have anything like that. The pain of "my /usr is not big enough and it's a hard disklabel partition with a completely separate filesystem omg how do I resize it" makes the partitioning sooooo not worth it.
That's assuming that the answer to this question is constant. I'm frequently running into the problem of / being too small on my notebook (I only have /, /home and /boot partitions) since I didn't anticipate my 2017 needs when installing the system in 2012. I really need to set aside some time to reinstall it...
This always makes me very anxious with Linux. I don't know beforehand what I'll use my laptop for, it's not a server! Some development, some gaming, some general use. Who knows? I always end up creating 3 partitions: /boot (is this really necessary?), a single huge /, and swap. I know a separate /home is recommended (something about backups and seamless distro upgrades, which I never do anyway), but I never know how to size it relative to /.
I admit I do cargo-cult partitioning. I don't really know whether the recommendations out there are current, outdated, mistaken or what.
I find a lot of recommendations about partitioning, swap, memory etc, at least for Linux, are cargo cult anyway, or at least outdated and/or poorly explained, which amounts to the same.
One potential solution for this is to use LVM, which lets you resize the partitions later. Even if you do just want to use /, /boot, and swap, it can be useful if you later want to change your swap size or reduce the root partition size to add new partitions if you decide you want to dual boot.
Easy example: create a 10gb EC2 instance with OpenBSD, start installing stuff, boom, you're out of space on some partition.
But really, just having rigid partitions makes me feel uneasy. ZFS datasets all share the same space, and you can set quotas if you want that can be changed anytime.
NB: Codeblock formatting on HN wraps exceptionally poorly (which is to say, not at all), on most devices.
Unlike some other operating systems, OpenBSD encourages users to split their disk into a number of partitions, rather than just one or two large ones. Some of the reasons for doing so are:
Security:
Some of OpenBSD's default security features rely on filesystem mount(8) options such as nosuid, nodev, noexec or wxallowed.
Stability:
A user or a misbehaved program can fill a filesystem with garbage if they have write permissions for it. Your critical programs, which hopefully run on a different filesystem, do not get interrupted.
Integrity:
If one filesystem is corrupted for some reason, then your other filesystems are most likely still OK.
fsck(8):
You can mount partitions that you never or rarely need to write to as readonly most of the time, which will eliminate the need for a filesystem check after a crash or power interruption.
The wxallowed mount option. W^X is now strictly enforced by default; a program can only violate it if it is located on a filesystem mounted with the wxallowed mount(8) option. This allows the base system to be more secure as long as /usr/local is a separate filesystem.
The base system has no W^X-violating programs, but the ports tree contains quite a few: chromium, mono, node, gnome, libreoffice, jdk, zeal, etc. If you want to run any of these ports on a regular basis, you need to add wxallowed to the mount options for /usr/local in fstab(5), e.g.:
Small disks may not have a separate partition for /usr/local. In that case, add wxallowed to the smallest partition containing it: /usr or /.
Starting a W^X-violating program from a partition without the wxallowed mount option will produce a core dump and the dmesg(8) will contain an entry such as soffice.bin(15529): mprotect W^X violation. You can temporarily allow W^X-violating ports by issuing mount -uo wxallowed /usr/local.
W^X ("Write XOR Execute"; spoken as W xor X) is a security feature in operating systems and virtual machines. It is a memory protection policy whereby every page in a process's or kernel's address space may be either writable or executable, but not both. Without such protection, a program can write (as data) CPU instructions in an area of memory intended for data and then arrange to run (as executable) those instructions. This can be dangerous if the writer of the memory is malicious.
The auto layout depends on the target drive size, your needs may vary but I set /usr/X11R6 to 1 GB and rarely see more used than 250 MB.
Generally I use the auto layout as a strong hint on how many partitions to make and the general size suggestions - then alter based on my needs (ie. bumping var instead of home for servers).
Do the BSDs support undervolting? Linux has Linux-PHC, but it seems to be broken, and in general the modern kernel does not play well with the old thinkpad I want to run this on. Did find nothing online, maybe someone here knows more?
FreeBSD has powerd, it works with P-states. You can also write to MSRs with cpucontrol(8), I think CPUs use that to adjust clock and voltage from the OS.
Under Linux, P-states are for Intel Core processors I think, but I do mean older than that. Pentium M. Maybe that's just not the case under BSD, or a mixup in terminology. cpucontrol could work here (but wow, that's raw). There seems to have been efforts to support it on other BSDs, https://mail-index.netbsd.org/tech-kern/2007/04/14/0003.html and http://www.daemonology.net/freebsd-est/ mentions the voltage (but it does not seem to be configurable, and if I got it right, this later became powerd).
From what I could gather one could use cpucontrol to change the stored voltages and then let powerd, powerd++ or however OpenBSD handles this do its work. Thanks for that. But it looks like no one ever tried and reported on this. Hm.
What is the best work around for graphical mounting/unmounting of a USB stick in version 6.1 and after? I'm using a doas line and the xfce-mount panel plug-in.
[Background: mounting/unmounting by non-root users was removed in 6.0(?) for security reasons and the toad daemon/hotplug solution became apparently unavailable)
PS: OpenBSD 6.1 on an older thinkpad (X200) just works fine with xfce4
I'm running OpenBSD on a Skylake-gen ThinkPad E560. There was support recently added for Skylake graphics to -current snapshots, nvme(4) is quickly replacing SATA on newer machines and is ready for 6.2. If you have a spare laptop, follow pitrh and give installing OpenBSD a shot.
Is this uncommon enough to need specifying? I've heard something along the lines of Ubuntu having no actual root user for security reasons, but I got no impression that this was a common approach. If root isn't a real user, what are your options when your main user is compromised?
72 comments
[ 5.3 ms ] story [ 139 ms ] threadI ended up putting FreeBSD on it and it worked great for a while. Then came the reboots, the lockups ... turns out I really should have run memtest86 first. The memory was bad; probably several other things too. I purchased it from a dodgy used shop and didn't realize all of this until past the 30 days. The memory on those models are soldered in too. I ended up eBaying it as a parts laptop.
Supposedly a fully functional X1 1st gen runs OpenBSD great. :-P
But then from the Gist the author linked wrt getting X working with HiDPI:
> I'm using X in full resolution of 2560x1440 with wsfb (backed by efifb(4)). I configured my X session for HiDPI (retina), so I had to calculate and set DisplaySize in xorg.conf to get the correct DPI. With my configuration below, most but not all fonts display correctly. A few widgets still have tiny fonts.
And later in that same Gist:
> I'm using Window Maker (since about 1997). It doesn't fully support HiDPI but it is possible to make it useable by tweaking the fonts. Some widgets are still tiny but window titles, menus etc. work fine.
So to fill in what comes after the ellipses for the typical respondent of news of a laptop running OpenBSD: "Really? But... wouldn't that require special trips to the internet to copy/paste configuration settings that still only partially solve the problem of a laptop running an OS that wasn't designed to run on a laptop?" And the answer seems to be: yes.
One more bullet point from that Gist:
> In /etc/sysctl.conf I have to disable suspend when the lid is closed: machdep.lidsuspend=0
But the blog author says suspend/resume does indeed work. Is the blog author manually suspending/resuming, or did he get it to trigger correctly when the lid is open/closed?
These problems seem related to the choice of WindowMaker, not OpenBSD. Choosing a different window manager or desktop environment won't have the same issues.
And ACPI events vary wildly, unless the two people are using the exact same model I wouldn't be surprised if their suspend/resume success is different.
Independent scaling per monitor is supposedly supported in Wayland and just around the corner in KDE so I live in hope. I hear it's mostly working in the very latest versions of Gnome now at least, although I couldn't get it to work.
(I appreciate that this is a thread about BSD - I'm just pointing out that the situation in Linux isn't much better)
[0] https://man.openbsd.org/iwm
Even with 802.11ad (that I don't have) there's a huge difference between having to plug in when you reach a "fast area" and not having to.
Going wired->wifi is like going desktop->laptop. I'll admit to being slow to go to both laptop and wifi years ago, but at least to me they're clearly superior.
Still I think it is awful.
I hear it is because the spectrum is jammed but I almost cannot believe it: I have a big garden and so have my neighbours.
What do you guys do to get fast, stable wireless?
The ubquiti has a spectrum survey mode that will tell you what sort of interference it sees on each channel. It takes 10's of minutes to run, and seems pretty thorough.
The real winning feature is that it is designed to be ceiling mounted, so I could place it in the center of my house, a few feet away from the nearest wall. There is also a mesh mode, where you buy more than one. If your house is big, and interference isn't the problem, that might help. I haven't tried it. They have newer / different models that do a better job of this than the UAP-Pro.
Later, I replaced my router with a pc engines apu2 running openbsd. Ubiquiti has a highly recommended cheap router (edgerouter lite) that works out of the box, if you aren't looking for a hobby project. People have gotten openbsd to run on it too.
I feel people have only used badly configured crappy consumer APs on crappy laptops (without MIMO) and don't understand that wifi doesn't have to be slow and unreliable.
"A deep dive into why Wi-Fi kind of sucks": https://arstechnica.com/information-technology/2017/03/802-e...
Good routers can go over 100Mbps, easily, and I would never think that 'less' speed is 'okay' in a world where increased speeds are just a requirement of technology over time, and usage, of said technology.
Note that I said 800-1100Mbps.
> but the problem has always been variable latency
Symptom of crappy consumer equipment.
> Any kind of interfere from the dozens of other Wi-Fi networks in the area seems to have an effect
Well yeah, that is why I use 5GHz which doesn't penetrate walls very well so I don't get any interference.
The power used is very low. More power just means more interference. The bottleneck is the transmit power on the client, which is very low. More power on the AP just make everything louder. I've set up power level based on this document: https://support.apple.com/en-us/HT203068. Unfortunately only Apple documents this stuff, but works pretty well for everything AFAICT.
I don't have any special antennas. If you need to cover a large space with a single AP you might need one, but the best philosophy on 5GHz is to have many smaller APs.
All my APs are connected through ethernet (actually everything is PoE powered). I don't use any mesh stuff (although Mikrotik can be used in that configuration, I don't recommend it). All my APs are simple bridges, I don't use the Mikrotik tunnel stuff.
I don't use 802.11r because Mikrotik can't do it yet. I am not sure if anyone except Cisco can do it. I wish I had 802.11r, this is my Achilles' heel.
Everything works very well, but you get what you pay for. Mikrotik is really cheap compared to the real stuff out there, which means much less polish, more bugs, and no real documentation. If I were to do it again I might chose Unifi[2] instead. Don't get me wrong, this all works very well, but the level of polish is what you'd expect out of a GitHub project compared to some real commercial product. For example while you can set antenna gain in standalone AP mode, you can't do it in managed AP mode. Minor stuff like that.
I also run a RADIUS server and I create user accounts for all my wireless users (WPA2 Enterprise). At different locations users have the same credentials.
I use all kinds of clients (Linux/BSD/macOS), but the ones where I'm most interested in speed are the Macbooks.
[1] https://routerboard.com [2] https://unifi-hd.ubnt.com
https://www.openbsd.org/60.html
https://www.openbsd.org/61.html
Not every project has engineers from Intel with internal datasheets, this came up before with USB 3.0 xHCI, which had Linux drivers long before the specs were public. There weren't even devices on the market!
OpenBSD is developed by volunteers.
Would definitely recommend this setup for folks not needing anything fancy (not for gaming/3d apps), but for your average web developer, it'll do the trick.
The caveat is that a T500 isn't exactly "modern" (c. 2006), but it's got a Core 2 Duo @ 2Ghz and 8G of ram, which is plenty for my admittedly modest needs.
Linux has the mess of NetworkManager
FreeBSD idled hard and also has wifi-supplicant and crap.
Solaris is a dead end and you can forget wifi.
OpenBSD was perfect, it felt so cleanly engineered with wifi/wpa handled by ifconfig.
the only concern was the bluetooth- they do not support, in any form, bluetooth. Because: "We have never seen a clean implementation of bluetooth". And yes, they trail with wifi support, but on a 7 year old laptop, that's fine.
Did wonders for my battery life too.
What's wrong with wpa_supplicant? It works really well, you just write one config file with all the networks and you can set the networks' priorities…
I guess there are advantages to the wpa_supplicant way of doing things too. But you have the option on openbsd too at least.
Somehow, OpenBSD on a 2012 x220 has all the energy saving features, suspend abilities, media buttons actions, etc you could hope for in the base system, without a full desktop environment.
I find this simplicity quite relaxing compared to linux, where you would have to install either a full DE or a bunch of not-so-well-integrated softwares (acpid, tlp, powertop, ...) to have your machine just-working with a simple terms+browser+tilingwm setup.
On the other hand, browser performance is not as great, virtualization, docker, USB automount and wifi roaming aren't really there. It doesn't make a difference for me though.
If I knew anything about filesystems at all I think I'd volunteer to get it done, it seems like a pressing issue that nobody seems to care about much. I'd rather be able to mount as many things as GNU/Linux can before even thinking about USB automount...
Mounting msdos filesystems works for me on NetBSD, maybe the OpenBSD folks could copy some code.
There are many things missing in obsd, but overall, I find the experience on a thinkpad relaxing enough to be worth it.
I admit I do cargo-cult partitioning. I don't really know whether the recommendations out there are current, outdated, mistaken or what.
I find a lot of recommendations about partitioning, swap, memory etc, at least for Linux, are cargo cult anyway, or at least outdated and/or poorly explained, which amounts to the same.
But really, just having rigid partitions makes me feel uneasy. ZFS datasets all share the same space, and you can set quotas if you want that can be changed anytime.
Flexible/resizable partitions are definitely easier, but I think you could have gotten the fixed scheme right if you had tried.
> create a 10gb EC2 instance
Unlike some other operating systems, OpenBSD encourages users to split their disk into a number of partitions, rather than just one or two large ones. Some of the reasons for doing so are:
Security:
Some of OpenBSD's default security features rely on filesystem mount(8) options such as nosuid, nodev, noexec or wxallowed.
Stability:
A user or a misbehaved program can fill a filesystem with garbage if they have write permissions for it. Your critical programs, which hopefully run on a different filesystem, do not get interrupted.
Integrity:
If one filesystem is corrupted for some reason, then your other filesystems are most likely still OK.
fsck(8):
You can mount partitions that you never or rarely need to write to as readonly most of the time, which will eliminate the need for a filesystem check after a crash or power interruption.
https://www.openbsd.org/faq/upgrade60.html
The wxallowed mount option. W^X is now strictly enforced by default; a program can only violate it if it is located on a filesystem mounted with the wxallowed mount(8) option. This allows the base system to be more secure as long as /usr/local is a separate filesystem.
The base system has no W^X-violating programs, but the ports tree contains quite a few: chromium, mono, node, gnome, libreoffice, jdk, zeal, etc. If you want to run any of these ports on a regular basis, you need to add wxallowed to the mount options for /usr/local in fstab(5), e.g.:
Small disks may not have a separate partition for /usr/local. In that case, add wxallowed to the smallest partition containing it: /usr or /.Starting a W^X-violating program from a partition without the wxallowed mount option will produce a core dump and the dmesg(8) will contain an entry such as soffice.bin(15529): mprotect W^X violation. You can temporarily allow W^X-violating ports by issuing mount -uo wxallowed /usr/local.
https://en.m.wikipedia.org/wiki/W%5EX
W^X ("Write XOR Execute"; spoken as W xor X) is a security feature in operating systems and virtual machines. It is a memory protection policy whereby every page in a process's or kernel's address space may be either writable or executable, but not both. Without such protection, a program can write (as data) CPU instructions in an area of memory intended for data and then arrange to run (as executable) those instructions. This can be dangerous if the writer of the memory is malicious.
Generally I use the auto layout as a strong hint on how many partitions to make and the general size suggestions - then alter based on my needs (ie. bumping var instead of home for servers).
Yeah right... Some strange demographics in there...
From what I could gather one could use cpucontrol to change the stored voltages and then let powerd, powerd++ or however OpenBSD handles this do its work. Thanks for that. But it looks like no one ever tried and reported on this. Hm.
[Background: mounting/unmounting by non-root users was removed in 6.0(?) for security reasons and the toad daemon/hotplug solution became apparently unavailable)
PS: OpenBSD 6.1 on an older thinkpad (X200) just works fine with xfce4
https://twitter.com/canadianbryan/status/867484974953508867
Is this uncommon enough to need specifying? I've heard something along the lines of Ubuntu having no actual root user for security reasons, but I got no impression that this was a common approach. If root isn't a real user, what are your options when your main user is compromised?
You can usually login by editing the grub kernel command line, and setting init=/bin/sh
Disk encryption may or may not make account recovery more complicated.