I'm a Slackware user who is investigating OpenBSD (waiting for the CDs right now).

I understand that OpenBSD is all about security. I also understand that OpenBSD focuses on the core OS, and that packages are extentions to that core OS. Also, OpenBSD recommends using packages and not compiling from source.

Given all this, I would have expected that the firefox package was updated more or less quickly after the official release. After upgrading to firefox 1.5.0.3 on Slackware today, I checked the OpenBSD package repository and the version available there is still 1.5.0.1.

Which makes me wonder - does OpenBSD care less about packages? Or are the vulnerabilities fixed on 1.5.0.2 and 1.5.0.3 simply not applicable on OpenBSD?

OpenBSD has a pretty small dev team and like you said, the core team is more concerned with the OS. Other stuff gets brought over when somebody on the dev team wants it. They're not shy about telling you: why isn't app x in the packages? Because the devs didn't want it. The other thing is that the majority of OpenBSD installations are servers. Desktop stuff doesn't get the same priority, again, unless the devs happen to want something. And those guys seem to prefer console tools (lynx comes with the base, for example) which is mostly ok by me. There are some pretty nice console apps for mail, browsing, rss feeds, etc.

I would say that OpenBSD doesn't view packages as OS extensions, not at all. They are completely separate issues. I think one of the reasons that OpenBSD is successful in terms of quality is that they draw a very clear line between what's OS and what's not. And if you ask a question about some package they are not shy about telling you to go ask the devs who wrote the app. It's not an OpenBSD issue.

I don't know the answer to your specific question, but I think it just comes down to how many guys they have and what their priorities are. There is certainly no reason (except for the fact that it's time consuming) not to build whatever you want from source. It's your system. But check the ports tree, because converting GNU make to Berkeley make sucks. I'm finding out now as I go in reverse because a lot of the paths are different between *BSD and Linux.

The other thing that is worth trying is looking at the FreeBSD packages. They have the most packages of any *BSD (I think) and they have mucho desktop users. You can probably get a FreeBSD package to work pretty easily.

You are right about the desktop aspect. As I use Slackware both as a server and as a desktop, I never make a difference between those 2 uses. But I thought that OpenBSD packages were held up to date such as with Linux distros, but this appears not to be the case. Good to know.

I uses to use FreeBSD but I dropped it for Slackware as a general-use OS. My interest in OpenBSD otoh is not to use it as a replacement for anything but to get familiar with its security concepts and its philosophy. I expect that a lot of things can also be applied to a Linux distro.

Thanks for your input. Helps me understand a little more.

Yeah, it's a really nice setup. I like OpenBSD a lot so far. 3.9 got a little fatter, but it's still a pretty lean and responsive system. It's very sensible to customize, but it is hard to find info on. Like Slackware, it has one guy who rules, and he has an agenda. I think that makes for a good distro.

Maybe when more of the Slackware guys start running OpenBSD machines the information sharing will become mo bettuh We can have our own subculture: OpenSlackers (tm)

To be fair, I've just seen that the port has been updated on May 5t, 2 days after FreeBSD's and Slackware's. Firefox 1.5.0.3 having been released on May 2nd.

Ok, but with Slackware you're talking about a ready-to-go executable package; on BSD you have to compile it. Not a big deal, but I hear that Mozilla takes forever. I don't know about Firebox.

Of course I'd prefer a compiled package, and that's in line with OpenBSD's philosophy and my lazyness. But compiling from source is the second option for staying "safe", so that would also be OK.

I compiled Firefox 1.5.0.2 on FreeBSD when it came out and yes it took quite a lot of time.

I have no problem with compiling stuff when compiling it with certain options, settings, etc. could increase performance or give you a flavor that's not readily available. But on utility stuff like browsers and other apps it really is nice not to have to build it yourself since 99.9% of all users can live with the same binary.

But I also don't need the latest browser, so I'm happy to live with an older version. On most of my systems as long as something works I pretty much never upgrade it.