Slashdot Log In
Theo de Raadt gets 2004 FSF Award
Posted by
CmdrTaco
on Sun Feb 27, 2005 09:32 AM
from the big-fancy-awards dept.
from the big-fancy-awards dept.
Caligari writes "Richard Stallman, presents this year's award to Theo de Raadt.
"For recognition as founder and project leader of the OpenBSD and OpenSSH projects. Theo de Raadt's work has also led to significant contributions to GNU/Linux and other BSD distributions. Of particular note is Theo's work on OpenSSH. Theo's leadership of OpenBSD, his selfless commitment to Free Software and his advancement of network security, were cited by this year's award committee.""
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
He deserves it ! (Score:5, Insightful)
Not only from a pure lines-of-code point-of-view, but also by the way the OpenBSD-project scrutinizes licenses and pushes security and cryptography forward every day.
Congratulations, Theo - keep on fighting !
Theo responds in typical BSD fashion... (Score:5, Funny)
He killed telnet! (Score:5, Insightful)
Imagine a world without the networking Swiss Army knife that is ssh.
OpenBSD is a totally underrated OS too. Even if it is a bit slow, its packet filter actually works.
Re:He killed telnet! (Score:5, Insightful)
In other words, the same thing as rsh, except it's encrypted which means you can safely use it over the internet. rsh brought computers on a given network together, and ssh brings computers cross WANs together. Sure you can do the same stuff with rsh, and then get rooted.
Congrads Theo! (Score:5, Insightful)
And I want to thank him for his other contributions, as it has made me some good cash, installing BSD boxes in front of Windows email servers with packet filtering!
Again Thanks Theo. I wish this type of stuff could reach more mainstream news, but we can all know just like other major happenings in the world, there is a army of unsung heros who make things happen.
For those wondering "why not linus" (Score:5, Informative)
Learn more about OpenBSD technology (Score:5, Informative)
There will be a number of talks this week in Dublin, Ireland from Theo de Raadt, Henning Brauer and Ryan McBride which are open to the public and completely free of charge!
Re:BSD and FSF? (Score:5, Interesting)
Re:BSD and FSF? (Score:5, Insightful)
It's IMHO rather silly to watch the flame wars between the GNU/Linux and *BSD sides when there is so much more that unites us than what divides us. This award make perfect sense. In the end a gnu, a penguin and a daemon can sometimes be noisy neighbourghs, but in the end they stick together to defend their building. Shitty alegory, I know, eh.
cheers,
fsmunoz
Re:BSD and FSF? (Score:5, Insightful)
BTW, care to explain how MS locks me in by using BSD code that I can go and pick up just about anywhere else.
Re:BSD and FSF? (Score:4, Informative)
BTW, care to explain how MS locks me in by using BSD code that I can go and pick up just about anywhere else.
That's more or less illustrating the point that you and most sane people don't really understand the difference between the freedoms of BSD and GPL
To answer your question though, here is an example:
In the mid 90s When it was time to put in a network layer into MS windows, MS decided to take some BSD code. They then took standard protocols like Kerberos, DNS, DHCP etc and tweaked them to work MS style so that people would be locked in to using the MS versions only. It was an intentional interoperability problem to make things work MS-to-MS but not MS-to-nonMS. It was part of the MS policy of embrace extend and extinguish, a policy that is elaborated in their leaked "halloween" document.
You can't get hold of the propietary, extended code for windows networking to fix the operatability problem without NDA etc. You can only guess the BSD code up to the moment of forking. After the fork point, the code has been tweaked and closed and used to build a system that tries to lock you in forever after. That's the kind of danger the GPL protects you against.
The restriction of GPL protects the coders in the long run.
The freedom of BSD can restrict the coders in the long run.
Re:BSD and FSF? (Score:5, Insightful)
If Microsoft does not use the code, they invent their own protocol. When Microsoft uses BSD code as a basis, they are at least easier to guess or work around. How long has it taken the people working on Samba to under all of the SMB protocol? Many years at least. Even Stallman has said the BSD license is good for standards.
BTW, the network stack in Windows has not been based on the BSD code for years.
The restriction of GPL protects the coders in the long run.
Protects coders from what? For example, when Microsoft embraces and extends a protocol (i.e., Kerberos, DNS, DHCP), they have no need for the source. They break the protocol. The GPL nor any other open source license would have power against that. You would need a patent (yuck).
The freedom of BSD can restrict the coders in the long run.
This is never true. I never need to use a proprietary vesion of open source. Which version of Kerberos do you use? With BSD-licensed code, I have very few restrictions placed upon me as a coder. Fewer than using GPL-licensed code.
Re:BSD and FSF? (Score:5, Informative)
(The following uses GPL for LGPL... and BSD for BSD, X...)
2004 Theo de Raadt (BSD)
2003 Alan Cox (GPL license)
2002 Lawrence Lessig (ALL)
2001 Guido van Rossum (Python license / BSDish license)
2000 Brian Paul (X license/BSDish )
1999 Miguel de Icaza (LGPL/GPLish)
1998 Larry Wall (Artistic/ closer to BSD than GPL but...)
Re:Linus Torvalds? (Score:5, Informative)
Is there a reason he didnt get this award?
I don't know whether this is still the policy, but from memory they originally aimed for this award to go to people who hadn't already received other awards for their work on free software. Linus has so wouldn't be eligible.
Re:Linus Torvalds? (Score:5, Informative)
Despite their differing views on what constitutes Free Software, though, both men are largely motivated by ideology. Consider Theo's reaction to the ipf debacle, his response to the XFree86 license change, and his appeal to the community to help fight the good fight against wlan cards that require non-freely redistributable binary firmware to function. This man is every bit as committed to software freedom as RMS is.
Linus, on the other hand, has stated publically on many occasions that he sees nothing wrong with proprietary software, and uses BitKeeper (a proprietary version control solution) to manage the Linux kernel tree (rather than say, CVS or Subversion) because, in his words, "it's better".
Without passing judgement, it is very clear that Linus values convenience above principle. This is part of the reason so many Slashbots like him: he is, in their minds, "refreshingly" a-political.
Whatever their differences, RMS and Theo are both idealistic. They are primarily motivated by their desire for Freedom, not because they want to produce the best system ever (although that may be true as well).
To me, RMS giving TdR this award is absolutely appropriate, and while I didn't expect it, I'm very pleased. I would be very surprised if Linus were named, and to be honest, I would be a little disappointed.
Not that I have anything against Linus, mind you -- he's a brilliant guy -- but at the core, he's an engineer, and so awarding him for his commitment to the ideology of Free Software would go rather against the grain, imho.
Re:Linus Torvalds? (Score:5, Insightful)
I've been personally involved with all these technologies. In my shop, we run two OpenBSD firewalls, one on each available broadband service. Our automated build system is based on SCons, and our scripts make heavy use of rsync internally. Our embedded surveillance project runs Linux which we compile in a chroot build environment along the lines of scratchbox (but scratchbox didn't exist when we started). We also have an ARM7 microcontroller in our product running on top of the GNU tools compilation environment, with some structural similarities to eCos/Redboot. Have I missed anyone?
I have a coworker here educated at the U. of Calgary (where I grew up myself) who knows (but does not enjoy) Theo through overlapping social circles. We had a short debate just a few weeks ago over a spicy Sichuan lunch special about where the boundaries between competence and personality belong. My coworker suggested "couldn't he accomplish as much without pissing people off?" I countered, "for someone with a knack for pissing people off, he retains some of the smartest out there within his circle. How does he do that?" There's a line I once read in Drucker that I've taken to heart "you're not in business to win friends". For me, the bottom line is that Theo delivers, and I admire the end results of his zealous rigour (regardless of where one might choose to draw the line between those qualities).
Before I became involved in this shop, I studied computational linguistics, which brought me into contact with just about everything in the area from which rsync originated. I was depressed that Tridge had to lose the award he deserves as much (well, almost as much, although it pains me to say it).
I've read all the benchmarks over the past year that show how OpenBSD is as slow as a senile dog. Whatever. For the purpose we employ those boxes, we've never had an iota of concern over performance level except for the negotiation phase on https. Guess what? Once Via/IBM finally coughs up the C7 Esther, OpenBSD running on a steroid enhanced 486 will crush the most expensive present day Pentium IV on our most essential performance metric.
The odd thing about OpenBSD, which many people never manage to assimilate, is that you have to look at that project through a very narrow gun turret to realize just how much they accomplish by entirely ignoring the whingings from everyone else.
It's an odd day in my personal universe to see RMS pat Theo on the back. I guess it takes one to know one after all.
Re:Linus Torvalds? (Score:5, Funny)
JUST KIDDING!
Re:There is somebody missing here: (Score:5, Interesting)
From the beginning, Linus has held the posistion of "eh, whatever" with regards to software freedom. He'll take advantage of it, but he's been very clear on where exactly software freedom is in his list of priorties (which is: below convience).
In contrast Theo has re-written whole parts of his operating system (pf and OpenSSH) for the sake of being able to give away an entirely free-for-any-use operating system.
While Linus has made an invaluble contribution to Open Source, Theo has proven time and time again to be a strong and active advocate for Free Software (with a capital 'F').
Re:Watch out! (Score:5, Insightful)
Re:Watch out! (Score:4, Insightful)
Re:hard to believe (Score:5, Insightful)
Why is OpenBSD called OpenBSD ? because it was the first BSD to make its CVS tree accessible for everyone. That's right, anyone can subscribe to source-changes and see the commit messages. And anyone can get the sources.
Now, most security fixes are NOT tagged as security fixes. They're tagged as clean-up, or reliability issues, or normal bug-fixes.
Why is this so ?
Quite simply, because those fixes are done while reading the code, NOT in reaction to a security hole.
That's what `proactive security' means. When you find something fishy, you just go and fix it, you don't sit on your fat ass and wait for months until someone finds a way to exploit it.
As a result, OpenBSD is more secure than most other OSes out there. Not because of cool technology like ProPolice or W^X, but simply because of good engineering practices.
OpenBSD doesn't have the latest cool feature. It's never been about that. But it has obsessive-compulsive developers who care about security.
Security is not a plug-in. It's not something you add to a distribution after you've put in all the carelessly designed and dangerous features.
Security is a process.
Security is a state of mind.
Security is a priority: either you put it right there, in front of you, and FIX THINGS when you think they might get broken, or... you will run into actual nasty holes, and make the front page of bugtraq.
Re:hard to believe (Score:4, Insightful)
Yes, most bugs we fix have some kind of security relevance. This is obvious. Now, are we going to tag each single entry we commit with `possible security fix' ? Are we going to spend a lot of time convincing other people this might be relevant ?
Nope, we are not.
We tried. This is simply a waste of time. It doesn't work. A lot of other projects don't have a clue. You tell them that what you're doing might be security-related, and you waste hours explaining the issue to them.
Think about it. Every time you simplify a piece of code, or replace an obfuscated algorithm with something simpler, you ARE handling security issues... or you might be. That's not important.
You are not going to waste time figuring out whether that fix is an actual security fix, or just some clean-up.
Because you can use the same amount of time fixing other issues, and that's more useful.
Want actual proof ? Look at all the changes in OpenBSD that replaced strcpy/strcat with strlcpy/strlcat. Now, go out on the linux lists, and ask why strlcpy still isn't a part of the glibc, but strfry is. Or look for comments on the above subject from Ulrich Drepper.
Make up your own mind.
Who do you think has a clue ?
The people who found out countless potential buffer overflows all over the place, fixed these, and still find that new code has the same mistakes and buffer overflows ?
Or the people who think that strlcpy is irrelevant because good programmers don't write buffer overflows ?
You could also look at tmpnam and mkstemp, and countless other examples.
As another instance, look at chroot and privilege separation. In many cases, the added safety translates to less features (like, a chroot'ed daemon that can no longer read its configuration file on a kill -HUP, or an http server that needs a whole set of libraries to run cgi). Bottomline, do you want the extra features, or the added security.
Most time, there is a trade. Those security fixes rely on non-portable parts of the libc. In many cases, third party software will buy back the extra stuff (look at rsync, kde and strlcpy), but this takes time...
try to do some development work, instead of posting opiniated, clueless comments on slashdot. Spend some time fixing security issues. See your patches take months to get accepted upstream. See the next release still have the bug, because some clueless, feature-conscious developer added some code with the exact same wrong pattern in another area than the one you've been fixing...
Re:Open* spinoffs & the Open Source idea? (Score:5, Interesting)
All that was free was the released version. There was some amount of political control of information.
Reread the exchange between Theo and the other members of NetBSD-core. One persistent complaint from Theo is that he could no longer easily work on the sparc port, because he did not have access to not yet released code.
Let's put aside any re-definition of freedom by the FSF, OSI and whatever group of the month is running this show.
No, this is not free development. Theo was not free to see what was going on in NetBSD in a technical sense. He had lost control. And the people in netbsd-core used that power to try and get Theo to promise he would change his behavior.
Whatever you might think of Theo's attitude (yes, he can be a complete fucker sometimes), that's not freedom, by any sense of the world.
Now, look at the world today. All BSDs have open cvs trees. I think that would have happened, eventually, but I'm 100% certain Theo's decision to make sure OpenBSD CVS tree would be totally open to public scrutiny at all times has a HUGE role to play in that change.
Re:Open* spinoffs & the Open Source idea? (Score:4, Insightful)
Or you could phrase this as
At the end of the day, OpenBSD was created because the 'first-tier' NetBSD developers used access controls to try and enforce social policy and Theo refused to be extorted.
This whole thing cuts both ways.
Re:Prime-time recognition for outstanding develope (Score:5, Interesting)
At one point I looked at the data and concluded that BSD was dying. I think that some people really think this and are not really trolling. The confusion comes in part due to a couple simple mistakes.
It is true that Netcraft has in the past indicated that *BSD is losing market share to Linux in at least the web server markets. However, these numbers are percentage based (regarding domains hosted) and probably don't represent an absolute decline. In fact, I suspect that the absolute number domain running on web servers running *BSD is probably currently growing but doing so slower than the market. This would fit with the observation that proprietary UNIX doesn;t seem to be in much of an absolute decline (with a few punctuations in the equalibrium) and that all such flavors are losing marketshare (percentage-wise) much faster than *BSD.
Secondly, because we are not seeing a mass exodus of the core developers from *BSD to Linux, I don't think one can ever say these are dying. Just as Microsoft can't kill Linux, Linux can't really kill *BSD. The only thing that can kill *BSD is, well, *BSD. More likely, we will see the licensing advantages that Linux offers disappear as proprietary UNIX and later Windows falls. At this point, Linux will still have some competative advantages, but we may see *BSD grow more rapidly once proprietary competition is eliminated.