[matesz]

As a side note NetBSD is THE ONLY operating system of which binaries are fully bit by bit reproducible.

Moreover it vendores patched gcc compiler, so the entire toolchain is reproducible too as well.

How cool is that?! For the record golang brings it further - its entire package registry containing +40mln packages is bit by bit reproducible.

[opan]

Are you sure GNU Guix System doesn't share this attribute?

[matesz]

Unfortunately it doesn't - even if our package definition doesn’t change output may, since software referenced by the package’s build function is not bit by bit reproducible.

The biggest issue is with Linux Kernel itself. Once kernel reproducibility will be handled, we can practically claim Guix, NixOS, Debian or any other Linux distro is reproducible as well, since with little effort we can avoid installing packages which will colour our reproducibility.

For desktop environments it’s a bit worse, but there are huge efforts to make this happen for all packages in package registries of aforementioned distros.

[eikenberry]

Debian has an ongoing project (https://wiki.debian.org/ReproducibleBuilds) to have 100% reproducible builds and are getting pretty close (numbers wise). Other Linux distros are working toward it as well. Many people care about this ... https://reproducible-builds.org/.

[pabs3]

Is NetBSD also reproducible from source without using NetBSD binaries?

https://bootstrappable.org/ https://stagex.tools/

[ksec]

I thought FreeBSD has it as well with v15?

[Imustaskforhelp]

I think I have read something like that similar as well.

Freebsd seems like an amazing project too.

I am always confused tho by what is the actual difference b/w freebsd,netbsd,openbsd as I feel like freebsd is taking a lot of positive ideas from both netbsd and openbsd or independently building them.

I might want to play with freebsd one day but I feel like it might have limited software or I might need to compile a lot of things as compared to archlinux or even debian etc.

[myaccountonhn]

They're quite different, but in subtle ways, and sometimes it's not about what they offer but rather what they don't offer.

What they all have in common is that they have great documentation, and they're all very unix-y and all have some virtualization support for linux.

Some things FreeBSD offer are good performance, IME the largest package repository, zfs integration, capsicum and jails. The experience IMO is a bit like Arch, except you'll rely less on a wiki and more on their official documentation.

OpenBSD and NetBSD offer a more "complete" experience like you'd expect from a desktop OS, while at the same time being quite minimal and simple.

OpenBSD focuses a lot on security, and is probably more likely to work with your hardware with fast wifi. It doesn't offer the same virtualization nor security the same type of security as Linux, but instead encourages you to pledge and unveil your applications, which means you lock down each application by saying what it can and can't do. It notoriously removes features from the kernel that are unmaintained and also doesn't include things it considers insecure like bluetooth. It's probably the OS that gives you the most "works out-of-the-box" experience.

NetBSD gives you a full desktop experience as well, but also has some unique security features like kauth, veriexec, extra-hardened chroot and security.curtain. It also offers some cool features like rumpkernels, smolbsd, and is probably the easiest to hack and compile yourself (even cross-compiling is very simple). It has a package manager, pkgsrc, that runs on many other OSes and it's also quite easy to port to new platforms. It's a fun OS to tinker with.

[Imustaskforhelp]

Wow really appreciate your message

I actually didn't know that openbsd and netbsd offer a more complete experience than as compared to freebsd

I had heard about openbsd a lot as well but freebsd I think is a lot more known in the nas community partially/wholely because of the zfs integration

Capsicum is definitely really interesting as well, I had heard of pledge partially because of justine tunney's cosmopolitan-esque port of pledge to linux and I was always fascinated by it

I wonder what is the state of software of openbsd /bsd's in general. I think another interesting thing that I found was that SSPL license could probably be bypassed if one can run freebsd etc., I am pretty sure that I had read one such comment regarding something similar on HN

Also, if I may ask, what is the difference with the linux kernel itself, I feel like bsd's have some security advantages which might make it a little bit more suitable for multi-tenancy. But the same things can be done in linux as well with things like podman / docker etc. or with firejail/bubblewrap/flatpak but with a higher cost like ram etc. or they can be considered bloated solutions as compared to bsd's but still.

What are some operating openbsd or some other servers which are used and where are they used, I used to see some apache servers in openbsd in some websites but what are your thoughts on the whole situation, I would love to know more about and thanks once again for your insightful comment!

[myaccountonhn]

I think much of what the BSDs offers can be achieved with Linux (and hardened Linux is probably just as secure), but it can be a lot more work and there is less guidance.

Locking down an Openbsd system is quite easy for example as it tries to have sane defaults. I find myself more in the dark with Linux.

Installing zfs on Linux is possible, but again can be a lot of work and it doesn't cleanly integrate with containers the same way zfs integrates with jails on Freebsd.

[NeutralForest]

Can you explain what reproducible mean in this context? Does that mean that you can recompile everything from "scratch" or does it have a deeper meaning?

[jraph]

Reproducible builds ensure that you can build the same binaries with the same source code. Nothing like the current date for instance gets in the way of getting a different build.

This allows independent people to check that provided binaries don't contain malicious stuff for instance. Ultimately, it lets you download binaries instead of rebuilding everything yourself locally if the binaries have been independently reproduced.

You might be interested in checking:

https://reproducible-builds.org/

https://en.wikipedia.org/wiki/Reproducible_builds

[irundebian]

The provided binaries may still contain malicious code but it guarantees that no malicious code has been inserted in between the build process of the published code. So if your binaries contain malicious code, you can be sure that all other users of the software version are affected, too.

[tuananh]

does anyone practice dual build pipeline? eg: 1 by your devops team and another one by your security team and compare binaries hash later. To verify everything is reproducible.

is it a common practice?

[indolering]

It is not common outside of security inclined communities like cryptocurrencies. It should be and we are slowly moving there.

[jraph]

Indeed, thanks for the precision!