! ! This list only mentions platform-independent changes. For a list of changes ! made in a particular platform, please check the page for that platform.
! !
!
! www@openbsd.org
! $OpenBSD: plus.html,v 1.13 1996/12/24 03:04:44 jkatz Exp $ ! ! ! --- 1,238 ---- ! ! ! !
OpenBSD
!!
Changes Relative to other *BSD's.
! !! OpenBSD looks a lot like NetBSD (from which it is derived, following ! the 4.4BSD roots), but is now being developed seperately. Good changes ! from other free operating systems will be merged in (of course, depending ! on various factors like developer time for example.) OpenBSD tracks ! NetBSD changes very closely; say anywhere between 2 to 10 days ! behind the state of NetBSD-current all the time. Hence you can truly ! say that OpenBSD is NetBSD PLUS MORE STUFF. ! !
! Compared to NetBSD, various additions have been made. This is a ! partial list of the major machine independent changes (ie. these are the ! changes people ask about most often). Check the page of the specific port ! you are interested in for further port-specific details. Note that many ports ! have had architecture-specific enhancements. ! !
-
!
- Many many NetBSD PR's fixed (which NetBSD has not yet fixed) !
- New curses library, including libform, libpanel and libmenu. !
- a termlib library which understands termcap.db, needed for new curses. !
- The FreeBSD ports subsystem was integrated and is usable by you! !
- ipfilter for filtering dangerous packets !
- better ELF support !
- nlist() that understands ELF, ECOFF, and a.out, allowing non-a.out ports ! to use kvm utilies !
- Verbatim integration of the GNU tools (using a wrapper Makefile) !
- All the pieces needed for cross compilation are in the source tree. !
- Some LKM support in the tree. !
- ATAPI support (should work on all ISA busses) !
- new scsi, md5, pkg_* commands !
- Numerous security related fixes !
- Kerberos and other crypto in the source tree that is exportable !
- Solid YP master, server, and client capabilities. !
- /dev/*random -- a device driver providing some kinds of random data !
- In-kernel update(8) with an adaptive algorithm !
- Some ddb improvements and extensions !
- Numerous scsi fixes !
- ncheck utility for ffs !
- /sbin/init now deals with non-existant ttys, no longer spins gettys madly. !
- new system calls: rfork(), minherit(), poll(). !
- select() that can handle any amount of file descriptors. !
- kernfs extensions !
- ATM support (support for one company's sparc & i386 cards available) !
- Boot kernels with "-c" to edit/enable/disable device configuration tables !
- pax as tar, gnutar is toast !
- using AT&T awk, gawk is toast !
- Even more security fixes. !
- Accepts FreeBSD MD5 passwords in password maps, soon will be able to ! generate them too !
- Linux ext2fs and BSD4.4 LFS support being worked on. !
- Working ATAPI audio support for multiple architectures. !
- terminfo database support. !
- Fortran in the tree. !
- The most secure rdist support anywhere. !
- randomized port allocation in bind(), bindresvport(), and rresvport() -- ! security via unpredictability. !
- Protection from the udp spamming and ftp bounce attacks. !
- Significantly improved ftp daemon. !
- Numerous more security policy and implimentation improvements (OpenBSD ! defaults to installing in a very secure mode) !
- zlib (non-GPL'd gzip-compatible library) !
- Newest version of pppd. !
- _POSIX_SAVED_IDS behaviour with permitted BSD extensions. !
- Fixed long-standing vm swap-leak. !
- FreeBSD malloc() that uses mmap() and is able to free unused memory. !
- Numerous FreeBSD userland fixes and improvements incorporated. !
- new rdisc Router Discovery daemon !
- generic protection against the bind() takeover problem. !
- at -f security fix. !
- 20 or so more security fixes !
- install now supports -C, -p, and -S flags. !
- a real adduser program, which can even be used uninteractively. !
- POSIX & C2 requirement; lose setuid/setgid bits if owner/group changed ! by chown(). This can be turned off with sysctl. !
- partial protection against tcp SYN attacks. !
- added /etc/fbtab support to login & init. !
- RCS version 5.7 !
- much newer join command (4.4lite2 with other fixes) !
- scsi subsystem security fix !
- Kerberos is much more silent if not configured !
- arc4-based random support in kernel !
- ncr53cXXX scsi scripts assembler !
- Numerous ftpd improvements and fixes, including multihomed and skey support. !
- `lsof'-style features in fstat. !
- rudimentary support for ISA Plug-and-Play cards !
- Fixed timeout support in RPC library, and also fixed it to support more ! than FD_SETSIZE file descriptors. !
- improved locate command !
- a good start at NETIPX support !
- vim version 4.5 !
- gcc 2.7.2.1 (to get closer to native alpha support ar gcc ! bugs). !
- latest version of perl, and a lndir command. !
- Even more security fixes. !
- cdio command for using CD audio. !
- Kernel warns f /dev/ces not ebooting ated /de
- libgis gone; our malloc() is better. !
- FreeBSD pipe() system call; quite a bit faster. !
- Some serial driver support for /dev/cuaXX devices to support transparent ! out+dial !
- DDcess symrom LKM es !
- Say goodbye to dump, restore, and mt security holes: They are no longer ! setuid. !
- *Hobbit*'s netcat utility. The crackers use it, so should you. !
- New routed from SGI. !
- Complete in-tree development for MIPS/Alpha systems (ie. binutils). !
- ftp command modified for easily scripted ftp & http downloads. !
- And of course... more security related bugfixes... (ie. dump, ! restore, mt). !
- vim is replacing nvi, since nvi does not have a pure BSD license, and vim ! also works better. !
- 16 partitions working on sparc and i386 (yipee!) !
- Nice sample files in /etc !
- sendmail gecos hole fixed (in a number of ways; other programs in the ! source tree were also vulnerable.) !
- secure multicast tools against possible security problems. !
- latest GNU groff, incorporated in a clean wrapperized form. !
- mopd for networking booting Digital machines !
- less version 2.90 !
- deal with the SYN bomb problem (denial of service attack) as well known. !
- Another kerberos security fix. !
- Almost a hundred more security fixes, including /tmp races because of strncpy. !
- Compile time option to compile the source tree almost completely dynamic. !
- A 7% reduction in size of static binaries. !
- FreeBSD's adduser(8) command. Also an rmuser(8) command. !
- We have completed security reviews of almost all userland programs and ! libraries except for the gnu stuff (where, based on preliminary ! inspection there is poor handling of temp files). !
- Working Linux ext2fs. !
- Added sudo (which is maintained by one of our developers) !
- CTM is now a supported way of obtaining OpenBSD source code. !
- The NIST Posix test suite became free. As a result we have been correcting ! numerous problems in the source tree, and expect to be completely ! POSIX compliant very soon. !
- upgrade to CVS version 1.9. !
- A number of security fixes to the way coredumping works. !
- The /dev/*random devices are now default on all architectures. !
- Add stack tracebacks to Arc port's kernel debugger. !
- Skey revamped into full OTP (RFC1938) support, including sha1 and ! md5 support. !
- GPL i387 emulator added. !
- Crank kvm space on the i386 port, also limit buffer cache useage ! so that 512MB machines may work (untested :-) !
- Numerous fixes to the lpr suite, including security. !
- More ftpd raging paranoia security fixes. !
- The NIST suite showed numerous errors in libraries and the kernel. ! Only a few small errors remain now, mostly regarding serial ! ports. !
- In numerous utilities: prefer $LOGNAME, but also accept $USER. !
- OLF binary type added. This is like ELF, but includes an OS-dependent ! tag. elf2olf(1) converts an elf binary to a tagged OLF binary which ! the kernel can recognize correctly. !
- Beware $HOME overflows throughout the source tree. !
- Integration of the pmax port. !
- Import of ctm. !
- Various repairs to the scsi scanner support. !
- Numerous more difficult-to-exploit-but-possible-if-someone-really-wanted-to ! buffer overflows found in system utilities.. !
- Memory leak paranoia in cron. !
- Make login get more consistantly upset about failed logins, and tell user ! about these failures at the next successfull login. !
- pdksh version is now 5.2.11 !
- New bsd.*.mk feature: DEBUG=-g. Try it, you'll like it. !
- The Arc port family has a new member: The rPC44 works! !
- lpt driver is now bus-independent. !
- com driver is now bus-independent. !
- Numerous small security fixes again... !
- Use pdksh as our /bin/sh. This provides excellent POSIX compliance. !
- Prevent generic users from mounting filesystems by default. !
- Added -C option to pax/tar. Also made -z support compressed files too. !
- Increased compatibility in the pccons driver with BSDi features. !
- Imported FreeBSD's calendar. !
- GNU gdb works on the mips-based platforms. !
- Add FreeBSD md5 diffs to mtree(8). This can be used to implement a ! tripwire-like system. !
- Some YP and bootparamd security changes. !
- Hundreds of little fixes all over the place. !
- Multiple updates for GNU software !
- Add disklabels to the floppy device drivers. !
- At boottime, have (*mountroot)() look at the root device's disklabel ! to determine which filesystem type is to be mounted. !
- If disklabel reading code discovers an ISOFS filesystem underlying, ! spoof a nice disklabel (enough to fool mountroot). !
- tcpdump 3.3 !
- Fix information gathering attack in ping(8). !
- Add NetBSD's "route show" implementation, and at the samet time fix ! the new buffer overflows that this provided. !
- Fix a few setgroups() related security holes. !
- sendmail 8.8.4 !
- texinfo 3.9 !
- f77 0.5.19 !
- Repair some more KerberosIV buffer overflows. Hard to believe this is ! supposed to be security software. !
- Add XCASE/IUCLC/OLCUC/OCRNL/ONOCR/ONLRET tty subsystem flags for ! backwards compatibility. !
- Permit NFS attribute cache to be configured on a per-mount basis. ! !
- Properly split fsck, mount, and newfs into multiple pieces. Use ! disklabel information if it is available. !
- Add disklabels to the vnd device driver. !
- Change the games to be run setgid games, not setuid games. This closes ! a whole slew of fascinating security holes. !
- Import of the powerpc port. !
- Properly use _POSIX_SAVED_IDS throughout the source tree. !
- Permit building of kernels without a.out support. !
- ppp 2.3b3 !
- libcrypt goes away. We do not need this stub library anymore. Do not link ! against it on OpenBSD, all the pieces you need are in libc. !
! ! This list only mentions platform-independent changes. For a list of changes ! made in a particular platform, please check the page for that platform.
! !
!
! www@openbsd.org
! $OpenBSD: plus.html,v 1.14 1996/12/24 08:37:33 deraadt Exp $ ! ! !