News for hackers. Stuff that matters.

A comment on CVE-2023-4809: FreeBSD pf bypass when using IPv6. Parent comment

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by rollcat on Friday September 08, 2023 @05:10PM (#37439480)
IIRC FreeBSD has a quite outdated version of pf, that hasn't been synced with OpenBSD upstream in quite a while.

I like FreeBSD for the breadth of features, but in some cases it feels like they've pushed it to an extreme, a bit of a kitchen sink. I don't think you need three different firewalls, a single good one would do a better job.

[ Parent | on HN ]
Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by toast0 on Friday September 08, 2023 @09:47PM (#37441388)
I don't know that it's necessarily outdated, more than it's a fork that evolved differently, and I don't think they'll reconverge.

I actively use ipfw and pf (at the same time!) because neither one can do all the things I need. I've never used the third one though.

[ Parent | on HN ]
Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by anthk on Saturday September 09, 2023 @06:28AM (#37443856)
That's why I prefer OpenBSD vs NetBSD and FreeBSD. Correctness at the core technologies before pushing any new cool feature.

>I don't think you need three different firewalls, a single good one would do a better job.

This.

[ Parent | on HN ]