OpenBSD出品的音乐专辑，请广大IT人士来瞧瞧能看懂听懂多少。歌曲可直接下载_openbsd音乐

Much of any operating system's usability depends on device support, and there are some very tempting alternative ways to support devices available to those who will surrender their moral code. A project could compromise by entering into NDA agreements with vendors, or including binary objects in the operating system for which no source code exists, or tying their users down with contract terms hidden inside copyright notices. All of these choices surrender some subset of the ideals, and we simply will not do this. Sure, we care about getting devices working, but not at the expense of our original goals.

Of course since "free to share with anyone" is part of our goals, we've been at the forefront of many licensing and NDA issues, resulting in a good number of successes. This success had led to much recognition for the advancement of Free Software causes, but has also led to other issues.

We fully admit that some BSD licensed software has been taken and used by many commercial entities, but contributions come back more often than people seem to know, and when they do, they're always still properly attributed to the original authors, and given back in the same spirit that they were given in the first place.

That's the best we can expect from companies. After all, we make our stuff so free so that everyone can benefit -- it remains a core goal; we really have not strayed at all in 10 years. But we can expect more from projects who talk about sharing -- such as the various Linux projects.

Now rather than seeing us as friends who can cooperatively improve all codebases, we are seen as foes who oppose the GPL. The participants of "the race" are being manipulated by the FSF and their legal arm, the SFLC, for the FSF's aims, rather than the goal of getting good source into Linux (and all other code bases). We don't want this to come off as some conspiracy theory, but we simply urge those developers caution -- they should ensure that the path they are being shown by those who have positioned themselves as leaders is still true. Run for yourself, not for their agenda.

The Race is there to be run, for ourselves, not for others. We do what we do to run our own race, and finish it the best we can. We don't rush off at every distraction, or worry how this will affect our image. We are here to have fun doing right.

Most parts of the operating system (from low kernel, through to libraries, all the way up to X, and then even to applications) use fairly obvious interface layers, where the "communication protocols" or "argument passing" mechanisms (ie. APIs) can be understood by any developer who takes the time to read the free code. Device drivers pose an additional and significant challenge though: because many vendors refuse to document the exact behavior of their devices. The devices are black boxes. And often they are surprisingly weird, or even buggy.

When vendor documentation does not exist, the development process can become extremely hairy. Groups of developers have found themselves focused for months at a time, figuring out the most simple steps, simply because the hardware is a complete mystery. Access to documentation can ease these difficulties rapidly. However, getting access to the chip documentation from vendors is ... almost always a negotiation. If we had open access to documentation, anyone would be able to see how simple all these devices actually are, and device driver development would flourish (and not just in OpenBSD, either).

When we proceed into negotiations with vendors, asking for documentation, our position is often weak. One would assume that the modern market is fair, and that selling chips would be the primary focus of these vendors. But unfortunately a number of behemoth software vendors have spent the last 10 or 20 years building political hurdles against the smaller players.

A particularly nasty player in this regard has been the Linux vendors and some Linux developers, who have played along with an American corporate model of requiring NDAs for chip documentation. This has effectively put Linux into the club with Microsoft, but has left all the other operating system communities -- and their developers -- with much less available clout for requesting documentation. In a more fair world, the Linux vendors would work with us, and the device driver support in all free operating systems would be fantastic by now.

We only ask that users help us in changing the political landscape.

This song details the process that Ty has to go through to make the art and music for each OpenBSD release. Ty and Theo really do go to a (very specific) bar and discuss what is going on in the project, and then try to find a theme that will work...

Order this CDROM from our International site.

The OpenBSD Audio celebrates the artwork and songs that have been released with each OpenBSD release. All the songs from the 3.0 to 4.0 releases are included (plus one bonus track by Ty Semaka explaining his role in the development of the art that accompanies OpenBSD releases).

Includes a 11cm silver-on-clear die-cut wireframe Puffy sticker!

• Blobs can be 'de-supported' by vendors
  at any time.
  
  
• Blobs cannot be supported by developers.
  
  
• Blobs cannot be fixed by developers.
  
  
• Blobs cannot be improved.
  
  
• Blobs cannot be audited.
  
  
• Blobs are specific to an architecture, thus
  less portable.
  
  
• Blobs are quite often massively bloated.
  

Take Adaptec for instance. Before the 3.7 release we disabled support for the aac(4) Adaptec RAID driver because negotiations with the Adaptec had failed. They refused to give us documentation. Without documentation, support for their controller had always been poor. The driver had bugs (which affected some users more than others) which caused crashes, and of course there was no RAID management support. Apparently most of these bugs are because the Adaptec controllers have numerous buggy firmware issues which require careful workarounds; without documentation we cannot solve these issues.

The driver was written by an OpenBSD developer, who cribbed parts of it from a FreeBSD driver written by an ex-Adaptec employee. But no public documentation exists, and Adaptec has dozens of cards with different firmware issues. All of this adds up to a very desperate development model -- it becomes very hard for the principle of "quality" to show its head.

RAID devices have two main qualities that people buy them for: 

• Redundancy
• Repair

Some vendors (or like the above Adaptec case, ex-employee) have sometimes given us some documentation so that we could write drivers, so that their devices could support Redundancy. But these vendors have never given us any documentation for performing Repairs.

Instead these vendors have tried to pass out non-free RAID management tools. These are typically gigantic Linux binaries, or some crazy thing, that is supposed to work through a bizarre interface in the device driver, which we are apparently supposed to write code for without any documentation.

And since we refuse to accept our users being forced into depending on vendor binaries, we have reverse engineered the management interface for the AMI controllers.

There is no great "intellectual property" in this stuff, it is all rather simple primitives. This is all that we need to implement basic RAID management:

• SCSI transactions on the back-side busses
• Discovering which drives are in which volumes
• Being able to silence the buzzer
• Marking a new drive as a Hot-Spare

The AMI driver needed to support these small primitive operations. And once we had that, we rely on something else which we know: Almost all the RAID controllers would need the same primitives.

Thus armed, we were able to write a generic framework which would later work on other vendors' RAID cards, that is, once we get documentation or do some reverse engineering for their products.

But having been ignored for so long by these vendors, it is not clear when (if ever) we will get around to writing that support for Adaptec RAID controllers now. And Adaptec has gone and bought ICP Vortex, which may mean we can never get documentation for the gdt(4) controllers. The "Open Source Friendly liar" IBM owns Mylex, and Mylex has told us we would not get documentation, either. 3Ware has lied to us and our users so many times they make politicians look saintly.

Until other vendors give us documentation, if you want reliable RAID in OpenBSD, please buyLSI/AMI RAID cards. And everything will just work.

And keep pestering the other vendors. 

While not exactly bait-and-switch, this is something which has been causing the community continual grief, and therefore we decided to honour a few of the projects that have decided to go non-free. After all.. having gone non-free, no one is going to remember them in the end.

This song is dedicated to a few worthy groups who have made this Free-to-Non-Free transition with their offerings in the last few years:

• David Dawes worked for years with a team of developers to make a free X11 distribution for us to use, called XFree86, 98% of which was based on entirely free code from MIT. Suddenly, one day, he decided that we must give him more credit (ie. advertise his name) or stop using it. Within about 4 months every project had told him to get stuffed, and the community has created a replacement effort. Now his team cannot even keep their web pages up to date...

• OpenBSD was the first operating system to integrate a packet filter, and it was the ipf codebase from Darren Reed that we chose. But a few years later he told us that we were not free to make changes to the code. So we deleted ipf, and our new packet filter far exceeds the capabilities of the one he wrote. And other projects are switching too...

• The Apache group started from the humble beginnings of just being 'a patchy' set of changes to a completely free web server of dubious quality. But the years have changed them, and what they supply is now quite non-free... released under a license so entangled in legalese that we have absolutely no doubt that there are encumbrances hidden within. Legal terms protect. Who are they protecting? Not your freedom.

But the town he found had suffered a blow
Fish were dying, cause the water was low
Fat cat fish name o' Diamond Dawes
Plugged the stream with copyright laws

He said my water's good n' my water's free
So Pond-erosa, you gonna thank me!
Then he bottled it up and he labeled it "Mine"
They opened n' poured, but they ran outta time!

So Puff made a brand and he tanned his hide
Said. "this is the mark of too much pride"
Tied him to a horse, set the tail on fire
Slapped er on the ass and the water went higher!

Pond-erosa Puff
wouldn't take no guff
Water oughta be clean and free
So he fought the fight
and he set things right
With his OpenBSD

Well things were good fer a spell in town
But then one day, dang water turned brown
Comin' to the rescue, Mayor Reed
He said, "This here filter's all ya'll need"

But it didn't take long 'fore the filter plugged
Full of mud, n' crud, n' bugs
Folks said "gotta be a gooder way"
Mayor said "Hell No! She's O.K."

"The water's fine on the Open range"
And he passed a law that it couldn't change.
"No freeze, no boil, no frolicking young"
Puff took him aside, said "this is wrong"

Then he found the Mayor was addin' the crud!
So he took him down in a cloud of blood
Said "The Mayor's learnd, he's done been mean"
So they did it right and the water went clean!

CHORUS

So once agin' it was right, but then
The lake went dry, she was gone again!
Fish started flippin' and floppin' about
Yellin' "Mercy Puff! It's a doggone drought!"

So he rolled up-gulch till he hit the lake
Of Apache fish, they was on the take
They'd built a dam that was made of rules
Now Puff was pissed and he lost his cool!

I'm sick and tired of these goldarn words!
n' laws n' bureaucratic nerds!
You're full o' beans n' killin' my town
and if you's all don't shut er down

I'll hang a lickin' on every one
of you sons o' bitchin' greedy scum!
So he blew the dam, an' he let 'er haul
Cause water oughta be free for all!

CHORUS

That's right!
I'll hang a lickin' on ya!
Never piss on another man's boot!

We've been working a few years now on our packet filtering software pf(4) and it became time to add failover. We want to be able to set up pf firewalls side by side, and exchange the stateful information between them, so that in case of failure another could take over 'keep state' sessions. Our pfsync(4) protocol solves this problem. However, on both sides of the firewall, it is also necessary to have all the regular hosts not see a network failure. The only reliable way to do this is for both firewall machines to have and use the same IP and MAC addresses. But the only real way to do that is to use multicast protocols.

The IETF community proposed work in this direction in the late 90's, however in 1997 Cisco informed them that they believed some of Cisco's patents covered the proposed IETF VRRP (Virtual Router Redundancy Protocol); on March 20, 1998 they went further and specifically named their HSRP "Hot Standby Router Protocol" patent. Reputedly, they were upset that IETF had not simply adopted the flawed HSRP protocol as the standard solution for this problem. Despite this legal pressure, the IETF community forged ahead and published VRRP as a standard even though there was a patent in the space. Why? There was much deliberation at all levels of the IETF, and unfortunately for all of us the politicians within eventually decided to allow patented technology in standards -- as long as the patented technology is licensed under RAND (Reasonable And Non Discriminatory) terms. As free software programmers, we therefore find ourselves in the position that these RAND standards must not be implemented by us, and we must deviate from the standard. We find all this rather Unreasonable and Discriminatory and we *will* design competing protocols. Some standards organization, eh?

Due to some HSRP flaws fixed by VRRP and for compatibility with the (HSRP-licensed) VRRP implementations of their competitors, Cisco in recent times has largely abandoned HSRP and now relies on VRRP instead -- a protocol designed for and by the community, but for which they claim patent rights.

On August 7 2002, after many communications, Robert Barr (Cisco's lawyer) firmly informed the OpenBSD community that Cisco would defend its patents for VRRP implementations -- meaning basically that it was impossible for a free software group to produce a truly free implementation of the IETF standard protocol. Perhaps this is because Cisco and Alcatel are currently engaged in a pair of patent lawsuits; a small piece of which is Cisco attempting to use the HSRP patent against Alcatel for their use of VRRP. Some IETF working group members took note of our complaints, however an attempt in April 2003 to have the IETF abandon the use of patented technology failed to "reach consensus" in the IETF.

A few years ago, the W3C, who designs our web protocols, tried to move to a RAND policy as well (primarily because of pressure from Microsoft and Apple), but the community outrage was so overpowering that they backed down. Some standards groups use this policy, while others avoid it -- the one differentiation being the amount of corporate participation. In the IETF, the pro-RAND agents work for AT&T, Alcatel, IBM, Cisco, Microsoft, and other large companies. Since IETF is an open forum, they can blend in as the populace, and vote just like all others, except against the community.

Translation: In failing to "reach consensus", the companies who benefit from RAND won, and the community lost again.

Left with little choice, we proceeded to reinvent the wheel or, more correctly, abandon the wheel entirely and go for a "hovercraft". We designed CARP (Common Address Redundancy Protocol) to solve the same problem that these other protocols are designed for, but without the same technological basis as HSRP and VRRP. We read the patent document carefully and ensured that CARP was fundamentally different. We also avoided many of the flaws in HSRP and VRRP (such as an inherent lack of security). And since we are OpenBSD developers, we designed it to use cryptography.

The combination of pf(4), pfsync(4), andcarp(4) has permitted us to build highly redundant firewalls. To date, we have built a few networks that include as many as 4 firewalls, all running random reboot cycles. As long as one firewall is alive in a group, traffic through them moves smoothly and correctly for all of our packet filter functionality. Cisco's low end products are unable to do this reliably, and if they have high end products which can do this, you most certainly cannot afford them.

As a final note of course, when we petitioned IANA, the IETF body regulating "official" internet protocol numbers, to give us numbers for CARP and pfsync our request was denied. Apparently we had failed to go through an official standards organization. Consequently we were forced to choose a protocol number which would not conflict with anything else of value, and decided to place CARP at IP protocol 112. We also placed pfsync at an open and unused number. We informed IANA of these decisions, but they declined to reply.

This ridiculous situation then inspired one of our developers to create this parody of the well-known Monty Python skit and song. 

As we did for the 3.3 release, we have once again tried making release artwork and music which are allegorical of recent happenings.

Two years ago we became involved with the University of Pennsylvania and DARPA, who were funding us to do security research and development .. on things that we were already intending to do. We provided ideas, wrote papers, and deployed cutting-edge technology; DARPA provided finances and reaped a share of the credit, and the University of Pennsylvania acted as a middle-man. We accepted funding based on the promise that our freedom to operate as we wished was unaffected. To us, freedom is more important than funding -- heck, we were dealing with the evil forces of government, and needed to be careful.

A few months prior to this release, DARPA suddenly and without warning decided to withdraw that funding; they also aggressively backed out of contractual obligations. Many articles in the press followed regarding this sudden maneuver. Apparently this hoopla happened because an OpenBSD-related article in the Canadian newspaper The Globe & Mail had quoted Theo de Raadt making anti-war statements regarding Iraq and the theft of oil.

The only answer given (to major media reporters) by a DARPA spokesperson (Jan Walker) was this:

"As a result of the DARPA review of the project, and due to world events and the evolving threat posed by increasingly capable nation-states, the Government on April 21 advised the University to suspend work on the "security fest" portion of the project."

That almost toes the line of calling us terrorists! We had lost financial support, but the release of the statement above suddenly made us very happy to be free of any perceived obligation to such crazy people.

Since the termination came near natural contract termination (about 4 months remained), less damage than expected was sustained by the project. Sponsors stepped forward and helped us make up the missing funds we needed to run our "Hackathon", and the event proceeded as planned. We even had T-shirts made with "Workstations of Mass Development" artwork for those developers who attended (sorry, they are not for sale).

We could not make stories like this up. So instead, we are making up an allegory about it, using the tale of Robin Hood.

A King ruled the web with fear
Spilling the blood of men
Then from the ocean came
Puff the Barbarian


Born in a tiny bowl Puff was a pet
Sold into slav-er-y by the man
Eating the weeds till he was strong enough
Breaking his bonds like nobody can

Down the sewer pipes of Hell
A thousand kitties then did bleed
Constraints were slain as well
Hacked his way out to the C

And there he found
His destiny
Hammer of the Ocean God
"Xor taking care of me"

Then in a dream Xor requested he
"Go to the Sun King, get what I yearn
Kernighan saw it, prophet of the C
Knowledge - so they may never return"

At the tower Puff appealed
For the wisdom of the One
Denied, his mind did reel
Puff was getting tired of Sun

Broke down the guard
Cause math is hard
Saw McNealy on his throne
All alone and only bones

Come the Sun King blade ablur
Hammer down eclipse the Sun
And Puff, the land secured
The new King Barbarian!

And the fish
Protecting us all from the cat
And the cat
Infecting the wo-orld for a laugh

Cyborg on a mission
To do some Puff fishin'
The doctor wants fugu tonight!

(short instrumental intro)

You'll need some machismo to
catch the spikey one
He's got guts and gizmos to
make the system run

But Flip's here for fun
and without a gun
He'll dice you with his Golden fin

She's all over Puff cause he's
such a sexy catch
Is she spying on him or
just a seafood match?

Oh double seven
Send me to Heaven
Cause for Mr. Po-o-o-ond

The women are fond
She knows what to do
She'll turn Gold to goo

Goldflipper is gone
Gold flipper's goooooooooooooone

Crackin' ze bathroom, Crackin' ze vault
Tale of the script, HEY! Secure by default

Can't fight the Systemagic
Über tragic
Can't fight the Systemagic

Sexty second, black cat struck
Breeding worm of crypto-suck
Hot rod box unt hunting wake
Vampire omellete, kitten cake

Crackin' ze boardroom, Crackin' ze vault
Rippin' ze bat, HEY! Secure by default

Chorus

Cybersluts vit undead guts
Transyl-viral coffin muck
Penguin lurking under bed
Puffy hoompa on your head

Crackin' ze bedroom, Crackin' ze vault
Crackin' ze whip, HEY! Secure by default
Crackin' ze bedroom, Crackin' ze vault
Crackin' ze whip, HEY! Secure by default

Chorus

During these hostile and trying times and what-not
OpenBSD may be your family's only line of defense

I'm secure by default

They that can give up liberty to obtain a little temporary safety
deserve neither liberty nor safety

RELEASE TIME!!!!

Stay off, stay off, stay off...
I'm secure by default
stay off, stay off, stay off