FSF Issues Statement On Shellshock Bash Vulnerability

[endman]

Given the margin of Unknown those statistics don't really tell us much:


All that says is that Linux has at least half (54.9%) of the UNIX share up to a potential 98.7%,
BSD has at least 1.4% of the market up to ~Half (45%)
and the same statement as BSD for the rest of the options including the unmentioned AIX

[nslay]

Some more points while I'm thinking about it more as to why BSD has stayed down

• Canonical, while I don't buy that they brought in as many people vs those who would have come in normally as they claim, as they didn't exactly advertise outside of what were already OSS contexts. Canonical did massive evangelization *inside* the OSS community to the point where it became the face of Linux and arguably of open source. Their CD programs along those lines were particularly important in an era where the internet was slow, and dial-up was still commonplace. Ultimately Canonical managed to grab a mindshare at the cost of everyone else.
• The "If we build it, they will come" mindset of most OSS projects, including the BSDs and most Linux distros means that you have to know to go looking for them, particularly when you've got a loud noisy group like the Ubuntu people drawing all of the attention. Red Hat and SUSE only really care about the enterprise market, and basically own it and so couldn't care less what Canonical is doing in the hobbyist space. What this means is that a project can't just sit there and expect to win, if they want to break into enterprise they have to fight Red Hat and SUSE, and if they want to break into the hobbyist market they have to take on Canonical. The BSDs (and for that matter most other linux distros) haven't been doing that.
• The BSDs up until 2006 didn't have a preconfigured distro for desktop users (PC-BSD), which meant that they were naturally limiting their target audience to the more hardcore geeks and sys admins, much the same as Gentoo and Arch do.
• While PC-BSD is doing a lot to solve the previous point, only in the past few years has it realized what it has to do and it's still working on getting there, however it's going to need a lot of work and polish. That said the direction and approach they're taking could in my opinion lead to a BSD renaissance (at least once FreeBSD catches up on hardware support)
• While ports are cool, BSD package management has until recently been absolute garbage. PBIs were there to work around it yes, but pkgng finally gives the overall system modern package management. I have no doubt in my mind that this has held them back
• BSD has lagged hard on modern graphics support, although this is in many respects a manpower issue, the BSDs are only now beginning to catch up to where Linux is, and they're still a long way off.
• The BSDs also seem to be lagging on wifi support, Broadcom AFAICT for instance appears to be completely unsupported
• Linux is wildly popular in the tech media whereas rarely anybody talks about BSD, that said the FreeBSD Foundation, iXSystems and a couple other organizations are beginning to do their own magazines to work on this problem.

In 5-6 years will BSD finally be a serious contender against Linux in terms of mind/market share? I don't know, but because they're finally working on solving some of their most pressing issues preventing them from being so, they have a chance. Just as Linux has a chance at finally competing against Windows over the next few years due to Valve. Regardless, the future will be very interesting over the next few years as we're entering another critical segment in open source history.

WiFi support lagging? Modern graphics support ...

I'm not trying to prop up BSD here, but BSD always had proper integration with ifconfig for Wi-Fi (as opposed to typical Linux hack iwconfig) and at one time (if not still) OpenBSD was considered king of Wi-Fi support of ALL Unix-like distributions.

And UMS/KMS issues aside, nVidia always provided bleeding edge support in its drivers to FreeBSD. Graphcis support has always been reasonable.

No, anything you said technical about BSD is not even wrong.

How about VFS? Where do you mention that (at one time you couldn't even unplug USB devices without a kernel trap). Or lack of journaled file systems (softupdates does not account for the disk re-ordering writes for example). How about lagging behind in kernel level MP support? Where's that point?

Wi-Fi and graphics support? You don't know anything about BSD!

Oh, and you also forgot that BSD always had package management (but nobody used it!) ... this is ancient history even before PC-BSD and PBI. You had pkg_add and friends and in fact people still ask about the relevance of pkgng when those tools existed all along!

[Luke_Wolf]

Endman, are you daft or did you not pay any attention to my previous post? These statistics are absolutely worthless because there is a 43.6% margin of uncertainty just on the unknowns themselves, which makes that graph absolutely worthless as well. If you continue to try to push these statistics as opposed to finding some that has a reasonable margin of uncertainty (e.g. <= 5%) then you'll just be showing intellectual dishonesty.

No conclusion, none whatsoever may be drawn from this data

[Luke_Wolf]

I'm not trying to prop up BSD here, but BSD always had proper integration with ifconfig for Wi-Fi (as opposed to typical Linux hack iwconfig) and at one time (if not still) OpenBSD was considered king of Wi-Fi support of ALL Unix-like distributions.

You noticed I was talking about drivers not tools right? The number of supported chipsets seems limited in the documentation, and broadcom in particular seems lacking vs what Linux provides, and I was reading in a recent mailing list thread that the wifi chipsets of the Thinkpad T440 are lacking drivers in FreeBSD which meant that particular user was SOL because the Thinkpad UEFI apparently checks whether the internal components are the same as in it's whitelist

And UMS/KMS issues aside, nVidia always provided bleeding edge support in its drivers to FreeBSD. Graphcis support has always been reasonable.

That's nice if you've got an NVidia card, and don't have Optimus, for everyone else they've got a lot of catching up to do as FreeBSD itself admits by it's upcoming XDC presentation. I for instance exclusively use AMD at this point because Radeon works so wonderfully under Linux since dynamic power management landed, which just also happens to be my blocker for throwing FreeBSD on actual hardware.

No, anything you said technical about BSD is not even wrong.

How about VFS? Where do you mention that (at one time you couldn't even unplug USB devices without a kernel trap). Or lack of journaled file systems (softupdates does not account for the disk re-ordering writes for example). How about lagging behind in kernel level MP support? Where's that point?

Wi-Fi and graphics support? You don't know anything about BSD!

Yeah well, I've been a Linux user for almost 10 years now, and have only been been paying attention to and playing with BSD for about a year and a half and only seriously looking into it since the release of FreeBSD 10 as opposed to just toying with it, so no I don't know that much about BSD. What I do know is from having read through the FreeBSD handbook, and online documentation, various wikipedia articles, as well as recent mailing list archives, playing around with PC-BSD 9.1 and now the 10 release in a VM, and various books, documentaries, and articles on the open source movement. I'm working on learning this stuff though, and if you want to make your own list go right ahead I'd appreciate seeing it, as it'll give me additional puzzle pieces.

Oh, and you also forgot that BSD always had package management (but nobody used it!) ... this is ancient history even before PC-BSD and PBI. You had pkg_add and friends and in fact people still ask about the relevance of pkgng when those tools existed all along!

Notice that I didn't say BSD lacked package management, I said it was garbage. pkg_add and friends are garbage, hence as you say nobody used it which is why they finally went and made pkgng which is finally a nice modern package manager.

[nslay]

You noticed I was talking about drivers not tools right? The number of supported chipsets seems limited in the documentation, and broadcom in particular seems lacking vs what Linux provides, and I was reading in a recent mailing list thread that the wifi chipsets of the Thinkpad T440 are lacking drivers in FreeBSD which meant that particular user was SOL because the Thinkpad UEFI apparently checks whether the internal components are the same as in it's whitelist

Linux is lacking (or some distribution was lacking as of January 2014) a driver for the Thinkpad 2x2 BGN+BT 4.0 (some kind of realtek chipset) in T440. Do I pretend that Linux doesn't support common Atheros, RealTek, Ralink, Broadcom chipsets present in almost all USB/PCIe devices? Yes, some laptops have Intel Wireless, but these are almost non-existent outside of laptops.

That's nice if you've got an NVidia card, and don't have Optimus, for everyone else they've got a lot of catching up to do as FreeBSD itself admits by it's upcoming XDC presentation. I for instance exclusively use AMD at this point because Radeon works so wonderfully under Linux since dynamic power management landed, which just also happens to be my blocker for throwing FreeBSD on actual hardware.

Right, with support for nVidia and Intel devices, the graphics support has always been quite reasonable.

Last time I used AMD on Linux, fglrx was a terrible driver (and ATi wasn't bought by AMD yet). Apparently that's changed.

Power has never been well supported on BSD. But I wouldn't consider that something that kept BSD down.

Yeah well, I've been a Linux user for almost 10 years now, and have only been been paying attention to and playing with BSD for about a year and a half and only seriously looking into it since the release of FreeBSD 10 as opposed to just toying with it, so no I don't know that much about BSD. What I do know is from having read through the FreeBSD handbook, and online documentation, various wikipedia articles, as well as recent mailing list archives, playing around with PC-BSD 9.1 and now the 10 release in a VM, and various books, documentaries, and articles on the open source movement. I'm working on learning this stuff though, and if you want to make your own list go right ahead I'd appreciate seeing it, as it'll give me additional puzzle pieces.

Maybe I'll chime in tomorrow. But there are a lot of reasons why BSD never caught on with the lawsuit being one of the biggest contributing reasons.

If you really want to learn BSD, then my advice is to play with FreeBSD itself and not PC-BSD. The whole point of PC-BSD was that you didn't have to know FreeBSD well to set it up to be your workstation. You literally start with nothing and get a getty login on your first boot. But then, FreeBSD never tried to appeal to Windows power users (which definitely helps keep it obscure and unpopular). But seriously, don't bother unless you have some time or some kind of Unix hobby. You know Linux well and it does the job for you.

Notice that I didn't say BSD lacked package management, I said it was garbage. pkg_add and friends are garbage, hence as you say nobody used it which is why they finally went and made pkgng which is finally a nice modern package manager.

pkg_add and friends could do almost anything pkgng could do (at least the things that I do with it), but was slower. Also packages weren't kept up to date (probably contributed to no one using it) as they are now with pkgng. I'm actually not clear why pkgng replaced those older tools or why the developers chose not to improve the older tools. Also, in the past, software wasn't as large as it is now and didn't take as long to compile. For example, if you want to build a recent version of Firefox in ports on an 8 core machine, it takes more than an hour with ports (which is clearly impractical). Add Qt, KDE/Gnome, Xorg to the list and it's insane to build a desktop environment from ports.

[gamerk2]

And the problems keep mounting up:

http://web.nvd.nist.gov/view/vuln/search-results?query=bash&search_type=last3months&cves=on

Boy, it almost seems like no one bothered to look at the code until after someone exploited a bug, but that would go against the entire argument of "Open Source is more secure because people are looking for problems".

[gsmith]

Same thing was fixed in sh over 20 years ago.

[gsmith]

And the problems keep mounting up:

http://web.nvd.nist.gov/view/vuln/search-results?query=bash&search_type=last3months&cves=on

Boy, it almost seems like no one bothered to look at the code until after someone exploited a bug, but that would go against the entire argument of "Open Source is more secure because people are looking for problems".

The only code in opensource that gets audited is openbsd's code and sometimes the linux kernel's code
In the linux world the only people really paying attention, security wise, to the linux kernel seem to be the PaX and grsecurity people. You know, people linus doesn't like (because he doesn't like "black and white" people).

What does linus like? He's pretty milquetoast... as far as I can tell the only thing he really likes, the thing that really gets him going and revved up... is Fat not so pretty Bitches(or women, or could be both).

Man. Fuck. Just look that shit up. I really do not understand it.

He threw away the only possible part of his life that could be good.
He got himself a fattie.

WTF. Atleast bill gates got a somewhat sorta more or less passable woman.

[tga.d]

Proof? Maybe you also need an official statement?
Nobody will give you "proof", proof is for sheeple waiting for fact handouts (when it's too late).
But smart people knew the government is spying on anyone the can reach out to long before any "proof" from Snowden and such.

link
link

The CPUs aren't the only type of compromised hw.

Since I haven't seen anyone else point it out, those links don't do anything to help your case. One of them is a forum post that cites Infowars (a conspiracy theory website) and is thoroughly debunked in a later comment, while the second link literally has half the article dedicated to explainging why the "NSA/Intel/whoever backdoor" is not the correct interpretation of the given information and that the researchers who presented it at Blackhat specifically said they think there are no NSA back doors.

[System25]

Oh, and you also forgot that BSD always had package management (but nobody used it!)

Because we need some really working package management with full-featured package manager and repos full of packages, not some third-rate crap with few poorly maintained packages. That's where Debian is unbeatable: about 45 000 packages + decent package manager. Interestingly, kfreebsd port got abandoned to degree they consider ditching it. BSD nuts are loud on statements and teaching others to live but suck when it comes to fixing their own crap.

No, dudes, we are not going to reduce our demands when it comes to operating systems. You either have to match expectations or you'll go to oblivion. And somehow just loud words instead of proper technical solutions would not do. Sorry about that.