1. 3

    One thing I wish could be easily ported to Linux from OpenBSD is relayd. In my constant excirse for minimalism and simplicity I’ve felt in love with suckless’ ii irc client, because its interface is pure text with tons of possibilities, I don’t need to run something depending on ncurses; but ii by design lacks of SSL or TLS functionalities (I like that) so they suggest to use a proxy that makes the connection for it, in OpenBSD relayd takes care flawlessly of the job, but there is nothing equivalent on Linux land, for the moment since I’m stuck on GNU/Linux I have to use socat with a named pipe.

    1. 4

      stunnel?

      1. 2

        That’s the one I needed, perhaps I was too tired late at night looking for proxy-only terms. Thank you for suggesting it, I will certainly try it whenever I get home, and see how it behaves.

    1. 3

      This is why you Don’t Implement Your Own Crypto! Come on folks.

      1. 9

        Sooo, You know that this is OpenSSH right? I mean someone has to write the Crypto. OpenSSH developers are among those that you might want to trust to do it right. No one is perfect though.

        1. 6

          Actually, the code in question was written by Tatu, before openssh was forked.

          Well, depending on exactly what code you mean. The key encrypting code was technically in OpenSSL (or librsa) I think. The choice to use it was Tatu’s.

          1. 3

            Pretty sure this comment was intended as a joke for this reason?

            1. 2

              Yeah it kind of was. I guess it was a little obscure though.

          2. 6

            Well, hop in a time machine back to 1996 and pick something better off the shelf…

            1. 1

              I read the article, and the situation seems related to OpenSSL only. Joel Sing confirmed that commits https://github.com/libressl-portable/openbsd/commit/17b1f1ce28ae8bc5a873951ad6c8aa564b68c0ab and https://github.com/libressl-portable/openbsd/commit/952c1252f58f5f57227f5efaeec0169759c77d72 fixed the issues back in 2017 for LibreSSL. More details by Billy Brumley to the oss-security earlier this year: http://www.openwall.com/lists/oss-security/2018/04/16/3 .

              In conclusion OpenBSD and Void Linux have this mitigated.

              1. 4

                Those commits have nothing to do with the issue in the article.

            1. 28

              Possibly unpopular opinions (and a large block of text) incoming:

              C++, Go, Swift, D and Rust all fail to adequately replace C for me. When given the choice, I would likely choose to just stick with C (for the moment; I’ll talk about what I’m considering at the end).

              C++ has so much historical baggage and issues, it’s already an immediate turn-off. More than that, it’s explicitly understood that you should carve out a subset of C++ to use as your language because trying to use the whole thing is a mess of sadness (given that it’s massive at this point). I appreciate the goal of zero-cost abstraction and having pleasant defaults in the standard library, but there are just too many problems for me to take it as a serious choice. Plus, I still have to deal with much of the unfortunate UB from C (not all of it, and honestly, I don’t mind UB in some cases; but a lot of the cases of UB in C that just make no reasonable sense come across to C++). It should be noted that I do still consider C++ occasionally in a C-with-templates style, but it’s still definitely not my preference.

              Despite how often people place it here, I do not believe Go belongs in this group of candidates The garbage collection alone makes it unfit for systems programming. I see Go as a very reasonable choice to replace Java (but I don’t use Java whenever I have the choice, so I might not be the best person to ask). There are many other parts of this language that rub me the wrong way, but mostly, I just think it’s not a good systems language (but is instead a great intro language for higher-level stuff).

              Swift is really easy to rule out: It’s not cross-platform. Even if it were, it has all sorts of terrible issues (have they fixed the massive compile times yet?) that make it a no-go.

              D, as far as I can tell, manages to be C++ without the warts in a really lovely way. Having said that, it seems like we’re talking about good replacements for C, not C++, and D just doesn’t cut it for me. GC by-default (being able to turn that off is good, but I’ll still have to do it every time), keeping name mangling by-default, etc. -betterC helps with some of this, but at that point, there’s just not enough reason for me to switch (especially with all the weirdness of there being two de facto standard libraries from different organizations, one of which I think is still closed-source? sounds like I might need to take another look at D; though, again, its emulation of C++ still suggests to me that it won’t quite cut it).

              Rust is the only language in this list that I think is actually a reasonable contender. Sadly, it still bites a lot of these issues: names are still mangled by-default, the generated binaries are huge (I’m still a little bugged that C’s hello-world with glibc dynamically links to 6KB), et al.

              But more than all of these things I’ve listed, the problems I have with these languages is that they all have a pretty big agenda (to borrow a term from Jon Blow). They all (aside from C++ which has wandered in the desert for many years) have pretty specific goals with how they are designed to try and carve out their ideal of what programming should be instead of providing tools that allow for people to build what they need.

              So, as for languages that I think might (someday, not soon really) actually replace C (for me):

              Zig strikes a balance between C (plus compile-time execution to replace the preprocessor) and LLVM IR internals which allow for incredibly fine-grained control (Hello arbitrarily-sized, fixed-width integers, how are you doing?). It also manages to have the best C interop story I have ever seen in a language so far (you can import from C header files no problem, and zig libraries can have their code called from C also no problem; astounding).

              Myr is still really new (so is Zig really), and has a lot left to figure out (e.g., its C interop story is not quite so nice yet). However, it manages to be incredibly simple and terse for a braced language. My guess is that, in the long run, myr will actually replace shell languages for me, but not C.

              Jai looks incredibly cool and embraces a lot of what I’ve mentioned above in that it is not a big agenda language, but provides a lot of really useful tools so that you can use what you make of it. However, it’s been in development for four years and there is no publicly available implementation (and I am worried that it may end up being closed-source when it is released, if ever). I’m hoping for the best here, but am expecting dark storms ahead.

              Okay, sorry for the massive post; let me just wrap up a few things. I do not mean to imply with this post that any of the languages above are inherently bad or wrong, only that they do not meet my expectations and needs in replacing C. For a brief sampling of languages that I love which suffer from all the problems I mentioned above and more, see here:

              • Haskell and Idris, but really Agda
              • Ada
              • Lua
              • APL (specifically, the unicode variants)
              • Pony

              They are all great and have brilliant ideas; they’re just not good for replacing C. :)

              Now then, I’ll leave you all to it. :)

              1. 15

                (especially with all the weirdness of there being two de facto standard libraries from different organizations, one of which I think is still closed-source?)

                That was resolved a few years ago. D just has one stdlib, it’s fairly comprehensive, and keeps getting better with each release.

                1. 12

                  a few years ago

                  a bit of an understatement! The competing library was dropped in 2007.

                2. 10

                  Despite how often people place it here, I do not believe Go belongs in this group of candidates The garbage collection alone makes it unfit for systems programming. I see Go as a very reasonable choice to replace Java (but I don’t use Java whenever I have the choice, so I might not be the best person to ask). There are many other parts of this language that rub me the wrong way, but mostly, I just think it’s not a good systems language (but is instead a great intro language for higher-level stuff).

                  Agreed with this. Go is my go-to when I need to introduce dependencies to a Python script (and thus fuck with pip --user or virtualenv or blah blah blah) for high level glue code between various systems (e.g. AWS APIs, etc.)

                  I think there’s a reason Go is dominating the operations/devops tooling world - benefits of static compilation, high level, easy to write.

                  Look at the amount of hacks Docker needs to do things like reexec etc. to work properly in Go, that would be trivial to do in C.

                  1. 3

                    Note that Zig is x86-only at the moment. Check “Support Table” on Zig’s README.

                    For that matter, Rust is x86-only too, if you want Tier-1 support.

                    1. 3

                      I’m a big d fan, but I agree that it’s the wrong thing to replace c. Betterc doesn’t really help in this respect, because it doesn’t address the root reason of why d is the wrong thing to replace c (which being that the language itself is big, not that the runtime or standard library are). Personally, I think zig is the future, but rust has a better shot at ‘making it’, and the most likely outcome is that c stays exactly where it currently is (which I’m okay with). I haven’t looked at myr (yet), and afaik isn’t jai targeted at game development? It might be used for systems programming, but I think it might not necessarily do well there.

                      It also manages to have the best C interop story I have ever seen in a language so far (you can import from C header files no problem, and zig libraries can have their code called from C also no problem; astounding)

                      I think nim does this, and d for sure does, with d++ (I think this may also help with the c++ emulation? Also, I’m not sure why you’re knocking it for its lack of quality c++ emulation when it’s afaik the only language that does even a mediocre job at c++).

                      1. 1

                        I agree!

                        As for knocking D for emulating C++, I did not mean to suggest that doing so is a count against D as a language, but rather just as a count against replacing C. I already ruled out C++, if a given language is pretty close to C++, it’s probably also going to be ruled out.

                        It’s been a long time since I looked at nim, but generating C code leaves a really poor taste in my mouth, especially because of some decisions made in the language design early on (again, I haven’t looked in a while, perhaps some of those are better now).

                        As for Jai, yes it’s definitely targeted at game development; however, the more I look at it, the more it looks like it might be reasonable for a lot of other programming tasks. Again though, at the moment, it’s just vaporware, so I offer no guarantee on that point. :)

                      2. 2

                        However, it’s been in development for four years and there is no publicly available implementation

                        I’m amazed that behind the project is Jonathan Blow, he is a legend programming original video games.

                      1. 2

                        Privacy is a simple and universal right, why just after GDPR, companies start to express their “strong commitment” with it, considering there have been issues to be addressed since the dawn of the digital age?

                        1. 2

                          Probably because not everyone else has shared your perspective until recently, probably.

                          1. 1

                            And you still have to trust Microsoft and whoever. IANAL but AFAICT they can still mess about with your data internally.

                            1. 1

                              Yes this statement is not legally binding, of course. I think what we’re seeing is more than MSFT is losing and it’s trying to win customers through non-technical means. Everyone knows Google’s business model is using your data and keeping up with that is very hard technically.

                          2. 2

                            It’s dangerous to adhere to privacy when your competition doesn’t have to. Selling out your users can end up making some nice additional cash.

                            With the GDPR there is a certain amount of advertising value that comes from it plus your competitors will have to adhere too.

                          1. 5

                            As exciting as this is, I’m wary about dependency in GNU tools, even though I understand providing an opembsd-culture-friendly implementation would require extra work and could be a nightmare maintainance, with two different codebases for shell scripts, but perhaps gmake could be replaced with something portable.

                            1. 12

                              This version of Wireguard was written in go, which means it can run on exactly 2 (amd64, i386) of the 13 platforms supported by OpenBSD.

                              The original Wireguard implementation written in C is a Linux kernel module.

                              A dependency on gmake is the least of all portability worries in this situation.

                              1. 18

                                While it’s unfortunate that Go on OpenBSD only supports 386 and amd64, Go does support more architectures that are also supported by OpenBSD, specifically arm64 (I wrote the port), arm, mips, power, mips. I have also implemented Go support for sparc64, but for various reasons this wasn’t integrated upstream.

                                Go also supports power, and it used to run on the power machines supported by OpenBSD, but sadly now it only runs on more modern power machines, which I believe are not supported by OpenBSD. However, it would be easy to revert the changes that require more modern power machines. There’s nothing fundamental about them, just that the IBM maintainer refused to support such old machines.

                                Since Go support both OpenBSD and the architectures mentioned, adding support in Go for OpenBSD+$GOARCH is about a few hours of work, so if there is interest there would not be any problem implementing this.

                                I can help and offer advice if anyone is willing to do the work.

                                1. 3

                                  Thanks for your response! I didn’t know that go supports so many platforms.

                                  Go support for sparc64, but for various reasons this wasn’t integrated

                                  Let me guess: Nobody wanted to pay the steep electricity bill required to keep a beefy sparc64 machine running?

                                  1. 23

                                    No, that wasn’t the problem. The problem was that my contract with Oracle (who paid me for the port) had simply run out of time before we had a chance to integrate.

                                    Development took longer then expected (because SPARC is like that). In fact it took about three times longer than developing the arm64 port. The lower level bits of the Go implementation have been under a constant churn which prevented us from merging the port because we were never quite synced up with upstream. We were playing a whack’a’mole game with upstream. As soon as we merged the latest changes, upstream had diverged again. In the end my contract with Oracle had finished before we were able to merge.

                                    This could all have been preventable if Google had let us have a dev.sparc64 branch, but because Google is Google, only Google is allowed to have upstream branches. All other development must happen at tip (impossible for big projects like this, also disallowed by internal Go rules), or in forks that then have to keep up.

                                    The Go team uses automated refactoring tools, or sometimes even basic scripts to do large scale refactoring. As we didn’t have access to any of these tools, we had to do the equivalent changes on our side manually, which took a lot of time and effort. If we had an upstream branch, whoever did these refactorings could have simply used the same tools on our code and we would have been good.

                                    I estimate we spent more effort trying to keep up with upstream than actually developing the sparc support.

                                    As for paying for electricity, Oracle donated one of the first production SPARC S7-2 machines (serial number less than 100) to the Go project. Google refused to pay for hosting this machine (that’s why it’s still sitting next to me as I type this).

                                    In my opinion after being involved with Go since the day of the public release, I’d say the Go team at Google is unfortunately very unsympathetic to large scale work done by non-Google people. Not actively hostile. They thanked me for the arm64 port, and I’m sure they are happy somebody did that work, but indirectly hostile in the sense that the way the Go team operates is not compatible with large scale outside contributions.

                                    1. 1

                                      Having to manually follow automated tools has to suck. I’d be overwhelmed by the tedium or get side-tracked trying to develop my own or something. Has anyone attempted a Go-to-C compiler developed to attempt to side-step all these problems? I originally thought something like that would be useful just to accelerate all the networking stuff being done in Go.

                                      1. 2

                                        There is gccgo, which is a frontend for gcc. Not quite a transpiler but it does support more architectures than the official compiler.

                                        1. 1

                                          Yeah, that sounds good. It might have a chance of performing better, too. The thing working against that is the Go compiler is designed for optimizing that language with the gccgo just being coopted. Might be interesting to see if any of the servers or whatever perform better with gccgo. I’d lean toward LLVM, though, given it seems more optimization research goes into it.

                                        2. 2

                                          The Go team wrote such a (limited) transpiler to convert the Go compiler itself from C to Go.

                                          edit: sorry, I misread your comment - you asked for Go 2 C, not the other way around.

                                          1. 1

                                            Hey, that’s really cool, too! Things like that might be a solution to security of legacy code whose language isn’t that important.

                                      2. 1

                                        But these people are probably more than comfortable with cryptocurrency mining 🙃

                                      3. 3

                                        Go also supports power, and it used to run on the power machines supported by OpenBSD, but sadly now it only runs on more modern power machines, which I believe are not supported by OpenBSD. However, it would be easy to revert the changes that require more modern power machines. There’s nothing fundamental about them, just that the IBM maintainer refused to support such old machines.

                                        The really stupid part is that Go since 1.9 requires POWER8…. even on big endian systems, which is very pointless because most running big endian PPC is doing it on pre-POWER8 systems (there’s still a lot!) or a big endian only OS. (AIX and OS/400) You tell upstream, but they just shrug at you.

                                        1. 3

                                          I fought against that change, but lost.

                                        2. 2

                                          However, it would be easy to revert the changes that require more modern power machines.

                                          Do you have a link to a revision number or source tree which has the code to revert? I still use a macppc (32 bit) that I’d love to use Go on.

                                          1. 3

                                            See issue #19074. Apparently someone from Debian already maintains a POWER5 branch.

                                            Unfortunately that won’t help you though. Sorry for speaking too soon. We only ever supported 64 bit power. If macppc is a 32-bit port, this won’t work for you, sorry.

                                            1. 3

                                              OpenBSD/macppc is indeed 32-bit.

                                              I kinda wonder if say, an OpenBSD/power port is feasible; fast-ish POWER6 hardware is getting cheap (like 200$) used and not hard to find. (and again, all pre-P8 POWER HW in 64-bit mode is big endian only) It all depends on developer interest…

                                              1. 3

                                                Not to mention that one Talos board was closer to two grand than eight or ten. Someone could even sponsor the OpenBSD port by buying some dev’s the base model.

                                                1. 3

                                                  Yeah, thankfully you can still run ppc64be stuff on >=P8 :)

                                        3. 2

                                          This version of Wireguard was written in go, which means it can run on exactly 2 (amd64, i386)

                                          That and syspatch make me regret of buying EdgeRouter Lite instead of saving up for an apu2.

                                        4. 2

                                          I’m a bit off with the dependency of bash on all platforms. Can’t this be achieved with a more portable script instead (POSIX-sh)?

                                          1. 3

                                            You don’t have to use wg-quick(8) – the thing that uses bash. You can instead set things up manually (which is really easy; wireguard is very simple after all), and just use wg(8) which only depends on libc.

                                            1. 2

                                              I think the same as you, I’m sure it is possibe to achieve same results using portable scripts. I’m aware of the conviniences bash offers, but it is big, slow, and prompt to bugs.

                                          1. 3

                                            Is there some context here for the unfamiliar?

                                            1. 14

                                              r (remote) commands like rcp, rlogin, rwho, etc.. (NOT rsync) are/were old unix commands largely superceded by their ssh alternatives about 15 years ago or so.

                                              They’re unencrypted, and from a time where security basically didn’t exist as an afterthought. Ideally they should be removed outright and relegated to the ports tree for anyone crazy enough to want to use them.

                                              The last time I had to use them was for a Solaris install of Oracle about 5 years ago, they stick around generally because nobody updates the scripts that use them. And for Oracle, god knows why they took so stupid long to not depend on the r commands to do their stupid db installs.

                                              Basically, these things are like ftp/telnet only for stuff you might do as root to copy stuff to other boxes or use to login and run commands on other boxes. But to use them you have to punch giant titanic sized holes through os security and allow stuff like man in the middle attacks across potentially untrusted network traffic.

                                              Good riddance to now obsolete rubbish in essence.

                                              1. 0

                                                It is impressive to see how much things have changed, in a short time. Computers are ubiquitous these days.

                                              2. 1

                                                There was some discussion on freebsd-arch@freebsd.org.