Encrypted Crash Dumps in FreeBSD, Time on Unix, Improve ZVOL sync write performance with a taskq, central log host with syslog-ng, NetBSD Entropy overhaul, Setting Up NetBSD Kernel Dev Environment, and more. Headlines EKCD - Encrypted Crash Dumps in FreeBSD  Some time ago, I was describing how to configure networking crash dumps. In that post, I mentioned that there is also the possibility to encrypt crash dumps. Today we will look into this functionality. Initially, it was implemented during Google Summer of Code 2013 by my friend Konrad Witaszczyk, who made it available in FreeBSD 12. If you can understand Polish, you can also look into his presentation on BSD-PL on which he gave a comprehensive review of all kernel crash dumps features. The main issue with crash dumps is that they may include sensitive information available in memory during a crash. They will contain all the data from the kernel and the userland, like passwords, private keys, etc. While dumping them, they are written to unencrypted storage, so if somebody took out the hard drive, they could access sensitive data. If you are sending a crash dump through the network, it may be captured by third parties. Locally the data are written directly to a dump device, skipping the GEOM subsystem. The purpose of that is to allow a kernel to write a crash dump even in case a panic occurs in the GEOM subsystem. It means that a crash dump cannot be automatically encrypted with GELI.  Time on Unix  Time, a word that is entangled in everything in our lives, something we’re intimately familiar with. Keeping track of it is important for many activities we do. Over millennia we’ve developed different ways to calculate it. Most prominently, we’ve relied on the position the sun appears to be at in the sky, what is called apparent solar time. We’ve decided to split it as seasons pass, counting one full cycle of the 4 seasons as a year, a full rotation around the sun. We’ve also divided the passing of light to the lack thereof as days, a rotation of the earth on itself. Moving on to more precise clock divisions such as seconds, minutes, and hours, units that meant different things at different points in history. Ultimately, as travel got faster, the different ways of counting time that evolved in multiple places had to converge. People had to agree on what it all meant.  See the article for more News Roundup Improve ZVOL sync write performance by using a taskq A central log host with syslog-ng on FreeBSD - Part 1  syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.  HEADS UP: NetBSD Entropy Overhaul  This week I committed an overhaul of the kernel entropy system.  Please let me know if you observe any snags!  For the technical background, see the thread on tech-kern a few months ago: https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html.  Setting Up NetBSD Kernel Dev Environment  I used T_PAGEFLT’s blog post as a reference for setting my NetBSD kernel development environment since his website is down I’m putting down the steps here so it would be helpful for starters.  Beastie Bits  You can now use ccache to speed up dsynth even more. Improving libossaudio, and the future of OSS in NetBSD DragonFlyBSD DHCPCD Import dhcpcd-9.0.2 with the following changes Reminder: watch this space for upcoming FreeBSD Office Hours, next is May 13th at 2pm Eastern, 18:00 UTC  Feedback/Questions  Ghislain - ZFS Question Jake - Paypal Donations Oswin - Hammer tutorial   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Encrypted Crash Dumps in FreeBSD, Time on Unix, Improve ZVOL sync write performance with a taskq, central log host with syslog-ng, NetBSD Entropy overhaul, Setting Up NetBSD Kernel Dev Environment, and more.</p> <h2>Headlines</h2> <h3><a href="https://oshogbo.vexillium.org/blog/74/" rel="nofollow" target="_blank">EKCD - Encrypted Crash Dumps in FreeBSD</a></h3> <blockquote> <p>Some time ago, I was describing how to configure networking crash dumps. In that post, I mentioned that there is also the possibility to encrypt crash dumps. Today we will look into this functionality. Initially, it was implemented during Google Summer of Code 2013 by my friend Konrad Witaszczyk, who made it available in FreeBSD 12. If you can understand Polish, you can also look into his presentation on BSD-PL on which he gave a comprehensive review of all kernel crash dumps features.</p> <p>The main issue with crash dumps is that they may include sensitive information available in memory during a crash. They will contain all the data from the kernel and the userland, like passwords, private keys, etc. While dumping them, they are written to unencrypted storage, so if somebody took out the hard drive, they could access sensitive data. If you are sending a crash dump through the network, it may be captured by third parties. Locally the data are written directly to a dump device, skipping the GEOM subsystem. The purpose of that is to allow a kernel to write a crash dump even in case a panic occurs in the GEOM subsystem. It means that a crash dump cannot be automatically encrypted with GELI.</p> </blockquote> <h3><a href="https://venam.nixers.net/blog/unix/2020/05/02/time-on-unix.html" rel="nofollow" target="_blank">Time on Unix</a></h3> <blockquote> <p>Time, a word that is entangled in everything in our lives, something we’re intimately familiar with. Keeping track of it is important for many activities we do.</p> <p>Over millennia we’ve developed different ways to calculate it. Most prominently, we’ve relied on the position the sun appears to be at in the sky, what is called apparent solar time.</p> <p>We’ve decided to split it as seasons pass, counting one full cycle of the 4 seasons as a year, a full rotation around the sun. We’ve also divided the passing of light to the lack thereof as days, a rotation of the earth on itself. Moving on to more precise clock divisions such as seconds, minutes, and hours, units that meant different things at different points in history. Ultimately, as travel got faster, the different ways of counting time that evolved in multiple places had to converge. People had to agree on what it all meant.</p> </blockquote> <p>See the article for more</p> <h2>News Roundup</h2> <h3><a href="https://github.com/openzfs/zfs/commit/0929c4de398606f8305057ca540cf577e6771c30" rel="nofollow" target="_blank">Improve ZVOL sync write performance by using a taskq</a></h3> <h3><a href="https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html" rel="nofollow" target="_blank">A central log host with syslog-ng on FreeBSD - Part 1</a></h3> <blockquote> <p>syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.</p> </blockquote> <h3><a href="https://mail-index.netbsd.org/current-users/2020/05/01/msg038495.html" rel="nofollow" target="_blank">HEADS UP: NetBSD Entropy Overhaul</a></h3> <blockquote> <p>This week I committed an overhaul of the kernel entropy system.  Please let me know if you observe any snags!  For the technical background, see the thread on tech-kern a few months ago: <a href="https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html" rel="nofollow" target="_blank">https://mail-index.NetBSD.org/tech-kern/2019/12/21/msg025876.html</a>.</p> </blockquote> <h3><a href="https://adityapadala.com/2020/04/20/Setting-Up-NetBSD-Kernel-Dev-Environment/" rel="nofollow" target="_blank">Setting Up NetBSD Kernel Dev Environment</a></h3> <blockquote> <p>I used T_PAGEFLT’s blog post as a reference for setting my NetBSD kernel development environment since his website is down I’m putting down the steps here so it would be helpful for starters.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.dragonflydigest.com/2020/05/04/24480.html" rel="nofollow" target="_blank">You can now use ccache to speed up dsynth even more.</a></li> <li><a href="http://blog.netbsd.org/tnf/entry/improving_libossaudio_and_the_future" rel="nofollow" target="_blank">Improving libossaudio, and the future of OSS in NetBSD</a></li> <li><a href="http://lists.dragonflybsd.org/pipermail/commits/2020-April/769021.html" rel="nofollow" target="_blank">DragonFlyBSD DHCPCD Import dhcpcd-9.0.2 with the following changes</a></li> <li><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow" target="_blank">Reminder: watch this space for upcoming FreeBSD Office Hours, next is May 13th at 2pm Eastern, 18:00 UTC</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Ghislain - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Ghislain%20-%20ZFS%20Question.md" rel="nofollow" target="_blank">ZFS Question</a></li> <li>Jake - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Jake%20-%20Paypal%20Donations.md" rel="nofollow" target="_blank">Paypal Donations</a></li> <li>Oswin - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/349/feedback/Oswin%20-%20Hammer%20tutorial.md" rel="nofollow" target="_blank">Hammer tutorial</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

Entropy Overhaul | BSD Now 349

FuryBSD 2020Q2 Images Available, Technical reasons to choose FreeBSD over GNU/Linux, Ars technica reviews GhostBSD, “TLS Mastery” sponsorships open, BSD community show their various collections, a tale of OpenBSD secure memory allocator internals, learn to stop worrying and love SSDs, and more. Headlines FuryBSD 2020Q2 Images Available for XFCE and KDE  The Q2 2020 images are not a visible leap forward but a functional leap forward.  Most effort was spent creating a better out of box experience for automatic Ethernet configuration, working WiFi, webcam, and improved hypervisor support.   Technical reasons to choose FreeBSD over GNU/Linux  Since I wrote my article "Why you should migrate everything from Linux to BSD" I have been wanting to write something about the technical reasons to choose FreeBSD over GNU/Linux and while I cannot possibly cover every single reason, I can write about some of the things that I consider worth noting.  News Roundup + Not actually Linux distro review deux: GhostBSD  When I began work on the FreeBSD 12.1-RELEASE review last week, it didn't take long to figure out that the desktop portion wasn't going very smoothly. I think it's important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review. GhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States.  “TLS Mastery” sponsorships open  My next book will be TLS Mastery, all about Transport Layer Encryption, Let’s Encrypt, OCSP, and so on. This should be a shorter book, more like my DNSSEC or Tarsnap titles, or the first edition of Sudo Mastery. I would like a break from writing doorstops like the SNMP and jails books.  JT (our producer) shared his Open Source Retail Box Collection on twitter this past weekend and there was a nice response from a few in the BSD Community showing their collections:  JT's post: https://twitter.com/q5sys/status/1251194823589138432  High Resolution Image to see the bottom shelf better: https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg Closeup of the BSD Section: https://twitter.com/q5sys/status/1251294290782928897  Others jumped in with their collections:  Deb Goodkin's collection: https://twitter.com/dgoodkin/status/1251294016139743232 &amp; https://twitter.com/dgoodkin/status/1251298125672660992 FreeBSD Frau's FreeBSD Collection: https://twitter.com/freebsdfrau/status/1251290430475350018 Jason Tubnor's OpenBSD Collection: https://twitter.com/Tubsta/status/1251265902214918144   Do you have a nice collection, take a picture and send it in! Tale of OpenBSD secure memory allocator internals - malloc(3)  Hi there, It's been a very long time I haven't written anything after my last OpenBSD blogs, that is,  OpenBSD Kernel Internals — Creation of process from user-space to kernel space. OpenBSD: Introduction to execpromises in the pledge(2) pledge(2): OpenBSD's defensive approach to OS Security So, again I started reading OpenBSD source codes with debugger after reducing my sleep timings and managing to get some time after professional life. This time I have picked one of my favourite item from my wishlist to learn and share, that is, OpenBSD malloc(3), secure allocator  How I learned to stop worrying and love SSDs  my home FreeNAS runs two pools for data. One RAIDZ2 with four spinning disk drives and one mirror with two SSDs. Toying with InfluxDB and Grafana in the last couple of days I found that I seem to have a constant write load of 1 Megabyte (!) per second on the SSDs. What the ...? So I run three VMs on the SSDs in total. One with Windows 10, two with Ubuntu running Confluence, A wiki essentially, with files for attachments and MySQL as the backend database. Clearly the writes had to stop when the wikis were not used at all, just sitting idle, right? Well even with a full query log and quite some experience in the operation of web applications I could not figure out what Confluence is doing (productively, no doubt) but trust me, it writes a couple of hundred kbytes to the database each second just sitting idle.  My infrastructure as of 2019  I've wanted to write about my infrastructure for a while, but I kept thinking, "I'll wait until after I've done $next_thing_on_my_todo." Of course this cycle never ends, so I decided to write about its state at the end of 2019. Maybe I'll write an update on it in a couple of moons; who knows?  For something different than our usual Beastie Bits… we bring you… We're all quarantined so lets install BSD on things!  Install BSD on something this week, write it up and let us know about it, and maybe we'll feature you!  Installation of NetBSD on a Mac Mini OpenBSD on the HP Envy 13 Install NetBSD on a Vintage Computer BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC Allan started a series of FreeBSD Office Hours  BSDNow is going Independent  After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements.What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.  Feedback/Questions  Todd - LinusTechTips Claims about ZFS   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>FuryBSD 2020Q2 Images Available, Technical reasons to choose FreeBSD over GNU/Linux, Ars technica reviews GhostBSD, “TLS Mastery” sponsorships open, BSD community show their various collections, a tale of OpenBSD secure memory allocator internals, learn to stop worrying and love SSDs, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.furybsd.org/furybsd-2020-q2-images-are-available-for-xfce-and-kde/" rel="nofollow" target="_blank">FuryBSD 2020Q2 Images Available for XFCE and KDE</a></h3> <blockquote> <p>The Q2 2020 images are not a visible leap forward but a functional leap forward.  Most effort was spent creating a better out of box experience for automatic Ethernet configuration, working WiFi, webcam, and improved hypervisor support. </p> </blockquote> <h3><a href="https://unixsheikh.com/articles/technical-reasons-to-choose-freebsd-over-linux.html" rel="nofollow" target="_blank">Technical reasons to choose FreeBSD over GNU/Linux</a></h3> <blockquote> <p>Since I wrote my article "Why you should migrate everything from Linux to BSD" I have been wanting to write something about the technical reasons to choose FreeBSD over GNU/Linux and while I cannot possibly cover every single reason, I can write about some of the things that I consider worth noting.</p> </blockquote> <h2>News Roundup</h2> <h3>+ <a href="https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-deux-ghostbsd/" rel="nofollow" target="_blank">Not actually Linux distro review deux: GhostBSD</a></h3> <blockquote> <p>When I began work on the FreeBSD 12.1-RELEASE review last week, it didn't take long to figure out that the desktop portion wasn't going very smoothly.</p> <p>I think it's important for BSD-curious users to know of easier, gentler alternatives, so I did a little looking around and settled on GhostBSD for a follow-up review.</p> <p>GhostBSD is based on TrueOS, which itself derives from FreeBSD Stable. It was originally a Canadian distro, but—like most successful distributions—it has transcended its country of origin and can now be considered worldwide. Significant GhostBSD development takes place now in Canada, Italy, Germany, and the United States.</p> </blockquote> <h3><a href="https://mwl.io/archives/6265" rel="nofollow" target="_blank">“TLS Mastery” sponsorships open</a></h3> <blockquote> <p>My next book will be TLS Mastery, all about Transport Layer Encryption, Let’s Encrypt, OCSP, and so on.</p> <p>This should be a shorter book, more like my DNSSEC or Tarsnap titles, or the first edition of Sudo Mastery. I would like a break from writing doorstops like the SNMP and jails books.</p> </blockquote> <h3>JT (our producer) shared his Open Source Retail Box Collection on twitter this past weekend and there was a nice response from a few in the BSD Community showing their collections:</h3> <ul> <li><p>JT's post: <a href="https://twitter.com/q5sys/status/1251194823589138432" rel="nofollow" target="_blank">https://twitter.com/q5sys/status/1251194823589138432</a></p> <ul> <li>High Resolution Image to see the bottom shelf better: <a href="https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg" rel="nofollow" target="_blank">https://photos.smugmug.com/photos/i-9QTs2RR/0/f1742096/O/i-9QTs2RR.jpg</a></li> <li>Closeup of the BSD Section: <a href="https://twitter.com/q5sys/status/1251294290782928897" rel="nofollow" target="_blank">https://twitter.com/q5sys/status/1251294290782928897</a></li> </ul></li> <li><p>Others jumped in with their collections:</p> <ul> <li>Deb Goodkin's collection: <a href="https://twitter.com/dgoodkin/status/1251294016139743232" rel="nofollow" target="_blank">https://twitter.com/dgoodkin/status/1251294016139743232</a> &amp; <a href="https://twitter.com/dgoodkin/status/1251298125672660992" rel="nofollow" target="_blank">https://twitter.com/dgoodkin/status/1251298125672660992</a></li> <li>FreeBSD Frau's FreeBSD Collection: <a href="https://twitter.com/freebsdfrau/status/1251290430475350018" rel="nofollow" target="_blank">https://twitter.com/freebsdfrau/status/1251290430475350018</a></li> <li>Jason Tubnor's OpenBSD Collection: <a href="https://twitter.com/Tubsta/status/1251265902214918144" rel="nofollow" target="_blank">https://twitter.com/Tubsta/status/1251265902214918144</a></li> </ul></li> </ul> <p>Do you have a nice collection, take a picture and send it in!</p> <h3><a href="https://bsdb0y.github.io/blog/deep-dive-into-the-OpenBSD-malloc-and-friends-internals-part-1.html" rel="nofollow" target="_blank">Tale of OpenBSD secure memory allocator internals - malloc(3)</a></h3> <blockquote> <p>Hi there,</p> <p>It's been a very long time I haven't written anything after my last OpenBSD blogs, that is, </p> <p>OpenBSD Kernel Internals — Creation of process from user-space to kernel space.</p> <p>OpenBSD: Introduction to <code>execpromises</code> in the pledge(2)</p> <p>pledge(2): OpenBSD's defensive approach to OS Security</p> <p>So, again I started reading OpenBSD source codes with debugger after reducing my sleep timings and managing to get some time after professional life. This time I have picked one of my favourite item from my wishlist to learn and share, that is, OpenBSD malloc(3), secure allocator</p> </blockquote> <h3><a href="https://www.ixsystems.com/community/threads/how-i-learned-to-stop-worrying-and-love-ssds.82617/" rel="nofollow" target="_blank">How I learned to stop worrying and love SSDs</a></h3> <blockquote> <p>my home FreeNAS runs two pools for data. One RAIDZ2 with four spinning disk drives and one mirror with two SSDs. Toying with InfluxDB and Grafana in the last couple of days I found that I seem to have a constant write load of 1 Megabyte (!) per second on the SSDs. What the ...?</p> <p>So I run three VMs on the SSDs in total. One with Windows 10, two with Ubuntu running Confluence, A wiki essentially, with files for attachments and MySQL as the backend database. Clearly the writes had to stop when the wikis were not used at all, just sitting idle, right?</p> <p>Well even with a full query log and quite some experience in the operation of web applications I could not figure out what Confluence is doing (productively, no doubt) but trust me, it writes a couple of hundred kbytes to the database each second just sitting idle.</p> </blockquote> <h3><a href="https://chown.me/blog/infrastructure-2019.html" rel="nofollow" target="_blank">My infrastructure as of 2019</a></h3> <blockquote> <p>I've wanted to write about my infrastructure for a while, but I kept thinking, "I'll wait until after I've done $next_thing_on_my_todo." Of course this cycle never ends, so I decided to write about its state at the end of 2019. Maybe I'll write an update on it in a couple of moons; who knows?</p> </blockquote> <h2>For something different than our usual Beastie Bits… we bring you…</h2> <h2>We're all quarantined so lets install BSD on things!  Install BSD on something this week, write it up and let us know about it, and maybe we'll feature you!</h2> <ul> <li><p><a href="https://e17i.github.io/articles-netbsd-install/" rel="nofollow" target="_blank">Installation of NetBSD on a Mac Mini</a></p></li> <li><p><a href="https://icyphox.sh/blog/openbsd-hp-envy/" rel="nofollow" target="_blank">OpenBSD on the HP Envy 13</a></p></li> <li><p><a href="https://www.rs-online.com/designspark/install-netbsd-on-a-vintage-computer" rel="nofollow" target="_blank">Install NetBSD on a Vintage Computer</a></p></li> <li><p><a href="https://twitter.com/allanjude/status/1251895348836143104" rel="nofollow" target="_blank">BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC</a></p></li> <li><p><a href="https://wiki.freebsd.org/OfficeHours" rel="nofollow" target="_blank">Allan started a series of FreeBSD Office Hours</a></p></li> </ul> <h2>BSDNow is going Independent</h2> <ul> <li>After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements.<br>What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at <a href="http://BSDNow.tv" rel="nofollow" target="_blank">BSDNow.tv</a> rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.</li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Todd - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/348/feedback/Todd%20-%20LinusTechTips'%20claims%20on%20ZFS.md" rel="nofollow" target="_blank">LinusTechTips Claims about ZFS</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

BSD Community Collections | BSD Now 348

Rethinking OpenBSD security, FreeBSD 2020 Q1 status report, the notion of progress and user interfaces, Comments about Thomas E. Dickey on NetBSD curses, making Unix a little more Plan9-like, Not-actually Linux distro review: FreeBSD, and more. Headlines Rethinking OpenBSD Security  OpenBSD aims to be a secure operating system. In the past few months there were quite a few security errata, however. That’s not too unusual, but some of the recent ones were a bit special. One might even say bad. The OpenBSD approach to security has a few aspects, two of which might be avoiding errors and minimizing the risk of mistakes. Other people have other ideas about how to build secure systems. I think it’s worth examining whether the OpenBSD approach works, or if this is evidence that it’s doomed to failure. I picked a few errata, not all of them, that were interesting and happened to suit my narrative.  FreeBSD 2020 Q1 Quarterly report  Welcome, to the quarterly reports, of the future! Well, at least the first quarterly report from 2020. The new timeline, mentioned in the last few reports, still holds, which brings us to this report, which covers the period of January 2020 - March 2020.  News Roundup The Notion of Progress and User Interfaces  One trait of modern Western culture is the notion of progress. A view claiming, at large, everything is getting better and better. How should we think about progress? Both in general and regarding technology?  Thomas E. Dickey on NetBSD curses  I was recently pointed at a web page on Thomas E. Dickeys site talking about NetBSD curses.  It seems initially that the page was intended to be a pointer to some differences between ncurses and NetBSD curses and does appear to start off in this vein but it seems that the author has lost the plot as the document evolved and the tail end of it seems to be devolving into some sort of slanging match.  I don't want to go through Mr. Dickey's document point by point, that would be tedious but I would like to pick out some of the things that I believe to be the most egregious.  Please note that even though I am a NetBSD developer, the opinions below are my own and not the NetBSD projects.  Making Unix a little more Plan9-like  I’m not really interested in defending anything. I tried out plan9port and liked it, but I have to live in Unix land. Here’s how I set that up. A Warning The suckless community, and some of the plan9 communities, are dominated by jackasses. I hope that’s strong enough wording to impress the severity. Don’t go into IRC for help. Stay off the suckless email list. The software is great, the people who write it are well-spoken and well-reasoned, but for some reason the fandom is horrible to everyone.  Not-actually Linux distro review: FreeBSD 12.1-RELEASE  This month's Linux distro review isn't of a Linux distribution at all—instead, we're taking a look at FreeBSD, the original gangster of free Unix-like operating systems. The first FreeBSD release was in 1993, but the operating system's roots go further back—considerably further back. FreeBSD started out in 1992 as a patch-release of Bill and Lynne Jolitz's 386BSD—but 386BSD itself came from the original Berkeley Software Distribution (BSD). BSD itself goes back to 1977—for reference, Linus Torvalds was only seven years old then. Before we get started, I'd like to acknowledge something up front—our distro reviews include the desktop experience, and that is very much not FreeBSD's strength. FreeBSD is far, far better suited to running as a headless server than as a desktop! We're going to get a full desktop running on it anyway, because according to Lee Hutchinson, I hate myself—and also because we can't imagine readers wouldn't care about it. FreeBSD does not provide a good desktop experience, to say the least. But if you're hankering for a BSD-based desktop, don't worry—we're already planning a followup review of GhostBSD, a desktop-focused BSD distribution.  Beastie Bits  Wifi renewal restarted HAMMER2 and a quick start for DragonFly Engineering NetBSD 9.0 Antivirus Protection using OPNsense Plugins BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC  BSDNow is going Independent  After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements. LinuxAcademy is now under new leadership, and we understand that cutbacks needed to be made, and that BSD is not their core product. That does not mean your favourite BSD podcast is going away, we will continue and we expect things will not look much different.  What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at BSDNow.tv rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.  Feedback/Questions  Jordyn - ZFS Pool Problem  debug - https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt  Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv            Your browser does not support the HTML5 video tag. 

<p>Rethinking OpenBSD security, FreeBSD 2020 Q1 status report, the notion of progress and user interfaces, Comments about Thomas E. Dickey on NetBSD curses, making Unix a little more Plan9-like, Not-actually Linux distro review: FreeBSD, and more.</p> <h2>Headlines</h2> <h3><a href="https://flak.tedunangst.com/post/rethinking-openbsd-security" rel="nofollow" target="_blank">Rethinking OpenBSD Security</a></h3> <blockquote> <p>OpenBSD aims to be a secure operating system. In the past few months there were quite a few security errata, however. That’s not too unusual, but some of the recent ones were a bit special. One might even say bad. The OpenBSD approach to security has a few aspects, two of which might be avoiding errors and minimizing the risk of mistakes. Other people have other ideas about how to build secure systems. I think it’s worth examining whether the OpenBSD approach works, or if this is evidence that it’s doomed to failure.<br/> I picked a few errata, not all of them, that were interesting and happened to suit my narrative.</p> </blockquote> <h3><a href="https://www.freebsd.org/news/status/report-2020-01-2020-03.html" rel="nofollow" target="_blank">FreeBSD 2020 Q1 Quarterly report</a></h3> <blockquote> <p>Welcome, to the quarterly reports, of the future! Well, at least the first quarterly report from 2020. The new timeline, mentioned in the last few reports, still holds, which brings us to this report, which covers the period of January 2020 - March 2020.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://herebeseaswines.net/essays/2020-04-13-the-notion-of-progress-and-user-interfaces" rel="nofollow" target="_blank">The Notion of Progress and User Interfaces</a></h3> <blockquote> <p>One trait of modern Western culture is the notion of progress. A view claiming, at large, everything is getting better and better.</p> <p>How should we think about progress? Both in general and regarding technology?</p> </blockquote> <h3><a href="https://implementality.blogspot.com/2020/04/thomas-e-dickey-on-netbsd-curses.html" rel="nofollow" target="_blank">Thomas E. Dickey on NetBSD curses</a></h3> <blockquote> <p>I was recently pointed at a web page on Thomas E. Dickeys site talking about NetBSD curses.  It seems initially that the page was intended to be a pointer to some differences between ncurses and NetBSD curses and does appear to start off in this vein but it seems that the author has lost the plot as the document evolved and the tail end of it seems to be devolving into some sort of slanging match.  I don't want to go through Mr. Dickey's document point by point, that would be tedious but I would like to pick out some of the things that I believe to be the most egregious.  Please note that even though I am a NetBSD developer, the opinions below are my own and not the NetBSD projects.</p> </blockquote> <h3><a href="https://woozle.org/papers/plan9.html" rel="nofollow" target="_blank">Making Unix a little more Plan9-like</a></h3> <blockquote> <p>I’m not really interested in defending anything. I tried out plan9port and liked it, but I have to live in Unix land. Here’s how I set that up.</p> <p>A Warning</p> <p>The suckless community, and some of the plan9 communities, are dominated by jackasses. I hope that’s strong enough wording to impress the severity. Don’t go into IRC for help. Stay off the suckless email list. The software is great, the people who write it are well-spoken and well-reasoned, but for some reason the fandom is horrible to everyone.</p> </blockquote> <h3><a href="https://arstechnica.com/gadgets/2020/04/not-actually-linux-distro-review-freebsd-12-1-release/" rel="nofollow" target="_blank">Not-actually Linux distro review: FreeBSD 12.1-RELEASE</a></h3> <blockquote> <p>This month's Linux distro review isn't of a Linux distribution at all—instead, we're taking a look at FreeBSD, the original gangster of free Unix-like operating systems.</p> <p>The first FreeBSD release was in 1993, but the operating system's roots go further back—considerably further back. FreeBSD started out in 1992 as a patch-release of Bill and Lynne Jolitz's 386BSD—but 386BSD itself came from the original Berkeley Software Distribution (BSD). BSD itself goes back to 1977—for reference, Linus Torvalds was only seven years old then.</p> <p>Before we get started, I'd like to acknowledge something up front—our distro reviews include the desktop experience, and that is very much not FreeBSD's strength. FreeBSD is far, far better suited to running as a headless server than as a desktop! We're going to get a full desktop running on it anyway, because according to Lee Hutchinson, I hate myself—and also because we can't imagine readers wouldn't care about it.</p> <p>FreeBSD does not provide a good desktop experience, to say the least. But if you're hankering for a BSD-based desktop, don't worry—we're already planning a followup review of GhostBSD, a desktop-focused BSD distribution.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://blog.netbsd.org/tnf/entry/wifi_renewal_restarted" rel="nofollow" target="_blank">Wifi renewal restarted</a></li> <li><a href="https://www.dragonflydigest.com/2020/04/21/24421.html" rel="nofollow" target="_blank">HAMMER2 and a quick start for DragonFly</a></li> <li><a href="http://netbsd.org/%7Ekamil/AsiaBSDCon/Kamil_Rytarowski_Engineering_NetBSD_9.0.pdf" rel="nofollow" target="_blank">Engineering NetBSD 9.0</a></li> <li><a href="https://www.youtube.com/watch?v=94vz_-5lAkE" rel="nofollow" target="_blank">Antivirus Protection using OPNsense Plugins</a></li> <li><a href="https://twitter.com/allanjude/status/1251895348836143104" rel="nofollow" target="_blank">BSDCan Home Lab Panel recording session: May 5th at 18:00 UTC</a></li> </ul> <h2>BSDNow is going Independent</h2> <ul> <li>After being part of Jupiter Broadcasting since we started back in 2013, BSDNow is moving to become independent. We extend a very large thank you to Jupiter Broadcasting and Linux Academy for hosting us for so many years, and allowing us to bring you over 100 episodes without advertisements. LinuxAcademy is now under new leadership, and we understand that cutbacks needed to be made, and that BSD is not their core product. That does not mean your favourite BSD podcast is going away, we will continue and we expect things will not look much different.  What does this mean for you, the listener? Not much will change, just make sure your subscription is via the RSS feed at <a href="http://BSDNow.tv" rel="nofollow" target="_blank">BSDNow.tv</a> rather than one of the Jupiter Broadcasting feeds. We will update you with more news as things settle out.</li> </ul> <h2>Feedback/Questions</h2> <ul> <li><p>Jordyn - <a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/347/feedback/Jordyn%20zfs%20pool%20problem.md" rel="nofollow" target="_blank">ZFS Pool Problem</a></p> <ul> <li>debug - <a href="https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt" rel="nofollow" target="_blank">https://github.com/BSDNow/bsdnow.tv/raw/master/episodes/347/feedback/dbg.txt</a></li> </ul></li> <li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></p></li> </ul> <p>          Your browser does not support the HTML5 video tag. </p>

New Directions | BSD Now 347

Tales from a core file, Lenovo X260 BIOS Update with OpenBSD, the problem of Unix iowait and multi-CPU machines, Hugo workflow using FreeBSD Jails, Caddy, Restic; extending NetBSD-7 branch support, a tale of two hypervisor bugs, and more. Headlines Tales From a Core File - Lessons from the Unix stdio ABI: 40 Years Later  On the side, I’ve been wrapping up some improvements to the classic Unix stdio libraries in illumos. stdio contains the classic functions like fopen(), printf(), and the security nightmare gets(). While working on support for fmemopen() and friends I got to reacquaint myself with some of the joys of the stdio ABI and its history from 7th Edition Unix. With that in mind, let’s dive into this, history, and some mistakes not to repeat. While this is written from the perspective of the C programming language, aspects of it apply to many other languages.  Update Lenovo X260 BIOS with OpenBSD  My X260 only runs OpenBSD and has no CD driver. But I still need to upgrade its BIOS from time to time. And this is possible using the ISO BIOS image. First off all, you need to download the “BIOS Update (Bootable CD)” from the Lenovo Support Website.  News Roundup The problem of Unix iowait and multi-CPU machines  Various Unixes have had a 'iowait' statistic for a long time now (although I can't find a source for where it originated; it's not in 4.x BSD, so it may have come through System V and sar). The traditional and standard definition of iowait is that it's the amount of time the system was idle but had at least one process waiting on disk IO. Rather than count this time as 'idle' (as you would if you had a three-way division of CPU time between user, system, and idle), some Unixes evolved to count this as a new category, 'iowait'.  My Latest Self Hosted Hugo Workflow using FreeBSD Jails, Caddy, Restic and More  After hosting with Netlify for a few years, I decided to head back to self hosting. Theres a few reasons for that but the main reasoning was that I had more control over how things worked. In this post, i’ll show you my workflow for deploying my Hugo generated site (www.jaredwolff.com). Instead of using what most people would go for, i’ll be doing all of this using a FreeBSD Jails based server. Plus i’ll show you some tricks i’ve learned over the years on bulk image resizing and more. Let’s get to it.  Extending support for the NetBSD-7 branch  Typically, some time after releasing a new NetBSD major version (such as NetBSD 9.0), we will announce the end-of-life of the N-2 branch, in this case NetBSD-7. We've decided to hold off on doing that to ensure our users don't feel rushed to perform a major version update on any remote machines, possibly needing to reach the machine if anything goes wrong. Security fixes will still be made to the NetBSD-7 branch. We hope you're all safe. Stay home.  Tale of two hypervisor bugs - Escaping from FreeBSD bhyve  VM escape has become a popular topic of discussion over the last few years. A good amount of research on this topic has been published for various hypervisors like VMware, QEMU, VirtualBox, Xen and Hyper-V. Bhyve is a hypervisor for FreeBSD supporting hardware-assisted virtualization. This paper details the exploitation of two bugs in bhyve - FreeBSD-SA-16:32.bhyve (VGA emulation heap overflow) and CVE-2018-17160 (Firmware Configuration device bss buffer overflow) and some generic techniques which could be used for exploiting other bhyve bugs. Further, the paper also discusses sandbox escapes using PCI device passthrough, and Control-Flow Integrity bypasses in HardenedBSD 12-CURRENT  Beastie Bits  GhostBSD 20.02 Overview FuryBSD 12.1 Overview&gt; Joe Maloney got in touch to say that the issues in the video and other ones found have since been fixed.  Now that's community feedback in action, and an example of a developer who does his best to help the community. A great guy indeed. OS108-9.0 amd64 MATE released FreeBSD hacking: carp panics &amp; test Inaugural FreeBSD Office Hours  Feedback/Questions  Shody - systemd question Ben - GELI and GPT Stig - DIY NAS   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Tales from a core file, Lenovo X260 BIOS Update with OpenBSD, the problem of Unix iowait and multi-CPU machines, Hugo workflow using FreeBSD Jails, Caddy, Restic; extending NetBSD-7 branch support, a tale of two hypervisor bugs, and more.</p> <h2>Headlines</h2> <h3><a href="https://fingolfin.org/blog/20200327/stdio-abi.html" rel="nofollow" target="_blank">Tales From a Core File - Lessons from the Unix stdio ABI: 40 Years Later</a></h3> <blockquote> <p>On the side, I’ve been wrapping up some improvements to the classic Unix stdio libraries in illumos. stdio contains the classic functions like fopen(), printf(), and the security nightmare gets(). While working on support for fmemopen() and friends I got to reacquaint myself with some of the joys of the stdio ABI and its history from 7th Edition Unix. With that in mind, let’s dive into this, history, and some mistakes not to repeat. While this is written from the perspective of the C programming language, aspects of it apply to many other languages.</p> </blockquote> <h3><a href="https://www.tumfatig.net/20200331/update-lenovo-x260-bios-with-openbsd/" rel="nofollow" target="_blank">Update Lenovo X260 BIOS with OpenBSD</a></h3> <blockquote> <p>My X260 only runs OpenBSD and has no CD driver. But I still need to upgrade its BIOS from time to time. And this is possible using the ISO BIOS image.</p> <p>First off all, you need to download the “BIOS Update (Bootable CD)” from the Lenovo Support Website.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/IowaitAndMultipleCPUs" rel="nofollow" target="_blank">The problem of Unix iowait and multi-CPU machines</a></h3> <blockquote> <p>Various Unixes have had a 'iowait' statistic for a long time now (although I can't find a source for where it originated; it's not in 4.x BSD, so it may have come through System V and sar). The traditional and standard definition of iowait is that it's the amount of time the system was idle but had at least one process waiting on disk IO. Rather than count this time as 'idle' (as you would if you had a three-way division of CPU time between user, system, and idle), some Unixes evolved to count this as a new category, 'iowait'.</p> </blockquote> <h3><a href="https://www.jaredwolff.com/my-latest-self-hosted-hugo-workflow/" rel="nofollow" target="_blank">My Latest Self Hosted Hugo Workflow using FreeBSD Jails, Caddy, Restic and More</a></h3> <blockquote> <p>After hosting with Netlify for a few years, I decided to head back to self hosting. Theres a few reasons for that but the main reasoning was that I had more control over how things worked.</p> <p>In this post, i’ll show you my workflow for deploying my Hugo generated site (<a href="http://www.jaredwolff.com" rel="nofollow" target="_blank">www.jaredwolff.com</a>). Instead of using what most people would go for, i’ll be doing all of this using a FreeBSD Jails based server. Plus i’ll show you some tricks i’ve learned over the years on bulk image resizing and more.</p> <p>Let’s get to it.</p> </blockquote> <h3><a href="http://blog.netbsd.org/tnf/entry/extending_support_for_the_netbsd" rel="nofollow" target="_blank">Extending support for the NetBSD-7 branch</a></h3> <blockquote> <p>Typically, some time after releasing a new NetBSD major version (such as NetBSD 9.0), we will announce the end-of-life of the N-2 branch, in this case NetBSD-7.</p> <p>We've decided to hold off on doing that to ensure our users don't feel rushed to perform a major version update on any remote machines, possibly needing to reach the machine if anything goes wrong.</p> <p>Security fixes will still be made to the NetBSD-7 branch.</p> <p>We hope you're all safe. Stay home.</p> </blockquote> <h3><a href="http://phrack.org/papers/escaping_from_freebsd_bhyve.html" rel="nofollow" target="_blank">Tale of two hypervisor bugs - Escaping from FreeBSD bhyve</a></h3> <blockquote> <p>VM escape has become a popular topic of discussion over the last few years. A good amount of research on this topic has been published for various hypervisors like VMware, QEMU, VirtualBox, Xen and Hyper-V. Bhyve is a hypervisor for FreeBSD supporting hardware-assisted virtualization. This paper details the exploitation of two bugs in bhyve - FreeBSD-SA-16:32.bhyve (VGA emulation heap overflow) and CVE-2018-17160 (Firmware Configuration device bss buffer overflow) and some generic techniques which could be used for exploiting other bhyve bugs. Further, the paper also discusses sandbox escapes using PCI device passthrough, and Control-Flow Integrity bypasses in HardenedBSD 12-CURRENT</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.youtube.com/watch?v=kFG-772WGwg" rel="nofollow" target="_blank">GhostBSD 20.02 Overview</a></li> <li><a href="https://www.youtube.com/watch?v=5V8680uoXxw" rel="nofollow" target="_blank">FuryBSD 12.1 Overview</a><br>&gt; Joe Maloney got in touch to say that the issues in the video and other ones found have since been fixed.  Now that's community feedback in action, and an example of a developer who does his best to help the community. A great guy indeed.</li> <li><a href="https://forums.os108.org/d/27-os108-9-0-amd64-mate-released" rel="nofollow" target="_blank">OS108-9.0 amd64 MATE released</a></li> <li><a href="https://www.twitch.tv/videos/584064729" rel="nofollow" target="_blank">FreeBSD hacking: carp panics &amp; test</a></li> <li><a href="https://www.youtube.com/watch?v=6qBm5NM3zTQ" rel="nofollow" target="_blank">Inaugural FreeBSD Office Hours</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Shody - <a href="http://dpaste.com/2SAQDJJ#wrap" rel="nofollow" target="_blank">systemd question</a></li> <li>Ben - <a href="http://dpaste.com/1S0DGT3#wrap" rel="nofollow" target="_blank">GELI and GPT</a></li> <li>Stig - <a href="http://dpaste.com/2NGNZG5#wrap" rel="nofollow" target="_blank">DIY NAS</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

Core File Tales | BSD Now 346

NetBSD 8.2 is available, NextCloud on OpenBSD, X11 screen locking, NetBSD and RISC OS running parallel, community feedback about switching to BSD, and more. Headlines NetBSD 8.2 is available!  The third release in the NetBSD-8 is now available. This release includes all the security fixes in NetBSD-8 up until this point, and other fixes deemed important for stability.   Some highlights include:   x86: fixed regression in booting old CPUs x86: Hyper-V Gen.2 VM framebuffer support httpd(8): fixed various security issues ixg(4): various fixes / improvements x86 efiboot: add tftp support, fix issues on machines with many memory segments, improve graphics mode logic to work on more machines. Various kernel memory info leaks fixes Update expat to 2.2.8 Fix ryzen USB issues and support xHCI version 3.10. Accept root device specification as NAME=label. Add multiboot 2 support to x86 bootloaders. Fix for CVE-2019-9506: 'Key Negotiation of Bluetooth' attack. nouveau: limit the supported devices and fix firmware loading. radeon: fix loading of the TAHITI VCE firmware. named(8): stop using obsolete dnssec-lookaside.   NextCloud on OpenBSD  NextCloud and OpenBSD are complementary to one another. NextCloud is an awesome, secure and private alternative for proprietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.   Preface   Back when this tutorial was initially written, things were different. The OpenBSD port relied on PHP 5.6 and there were no package updates. But the port improved (hats off, Gonzalo!) and package updates were introduced to the -stable branch (hats off, Solene!). A rewrite of this tutorial was long overdue. Right now, it is written for 6.6 -stable and will be updated once 6.7 is released. If you have any questions or desire some help, feel free to reach out.  News Roundup X11 screen locking: a secure and modular approach  For years I’ve been using XScreenSaver as a default, but I recently learned about xsecurelock and re-evaluated my screen-saving requirements  NetBSD and RISC OS running parallel  I have been experimenting with running two systems at the same time on the RK3399 SoC. It all begun when I figured out how to switch to the A72 cpu for RISC OS. When the switch was done, the A53 cpu just continued to execute code. OK I thought why not give it something to do! My first step was to run some small programs. It worked!  Thanks to Tom Jones for the pointer to this article   Several weeks ago we covered a story about switching from Linux to BSD.  Benedict and JT asked for community feedback as to their thoughts on the matter.  Allan was out that week, so this will give him an opportunity to chime in with his thoughts as well.  Jamie - Dumping Linux for BSD Matt - BSD Packaging Brad - Linux vs BS MJ - Linux vs BSD Feedback Ben - Feedback for JT Henrik - Why you should migrate everything to BSD  Beastie Bits  ssh-copy-id now included OPNsense 20.1.3 released A Collection of prebuilt BSD Cloud Images Instant terminal sharing  Feedback/Questions  Ales - Manually verify signature files for pkg package Shody - Yubikey Mike - Site for hashes from old disks  Answer: https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv            Your browser does not support the HTML5 video tag. 

<p>NetBSD 8.2 is available, NextCloud on OpenBSD, X11 screen locking, NetBSD and RISC OS running parallel, community feedback about switching to BSD, and more.</p> <h2>Headlines</h2> <h3><a href="http://blog.netbsd.org/tnf/entry/netbsd_8_2_is_available" rel="nofollow" target="_blank">NetBSD 8.2 is available!</a></h3> <blockquote> <p>The third release in the NetBSD-8 is now available.</p> <p>This release includes all the security fixes in NetBSD-8 up until this point, and other fixes deemed important for stability.</p> </blockquote> <ul> <li>Some highlights include:  <ul> <li>x86: fixed regression in booting old CPUs</li> <li>x86: Hyper-V Gen.2 VM framebuffer support</li> <li>httpd(8): fixed various security issues</li> <li>ixg(4): various fixes / improvements</li> <li>x86 efiboot: add tftp support, fix issues on machines with many memory segments, improve graphics mode logic to work on more machines.</li> <li>Various kernel memory info leaks fixes</li> <li>Update expat to 2.2.8</li> <li>Fix ryzen USB issues and support xHCI version 3.10.</li> <li>Accept root device specification as NAME=label.</li> <li>Add multiboot 2 support to x86 bootloaders.</li> <li>Fix for CVE-2019-9506: 'Key Negotiation of Bluetooth' attack.</li> <li>nouveau: limit the supported devices and fix firmware loading.</li> <li>radeon: fix loading of the TAHITI VCE firmware.</li> <li>named(8): stop using obsolete dnssec-lookaside.</li> </ul></li> </ul> <h3><a href="https://h3artbl33d.nl/2020-nextcloud.html" rel="nofollow" target="_blank">NextCloud on OpenBSD</a></h3> <blockquote> <p>NextCloud and OpenBSD are complementary to one another. NextCloud is an awesome, secure and private alternative for proprietary platforms, whereas OpenBSD forms the most secure and solid foundation to serve it on. Setting it up in the best way isn’t hard, especially using this step by step tutorial.</p> </blockquote> <ul> <li>Preface</li> </ul> <blockquote> <p>Back when this tutorial was initially written, things were different. The OpenBSD port relied on PHP 5.6 and there were no package updates. But the port improved (hats off, Gonzalo!) and package updates were introduced to the -stable branch (hats off, Solene!).</p> <p>A rewrite of this tutorial was long overdue. Right now, it is written for 6.6 -stable and will be updated once 6.7 is released. If you have any questions or desire some help, feel free to reach out.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="http://leahneukirchen.org/blog/archive/2020/01/x11-screen-locking-a-secure-and-modular-approach.html" rel="nofollow" target="_blank">X11 screen locking: a secure and modular approach</a></h3> <blockquote> <p>For years I’ve been using XScreenSaver as a default, but I recently learned about xsecurelock and re-evaluated my screen-saving requirements</p> </blockquote> <h3><a href="http://www.update.uu.se/%7Emicken/ronetbsd.html" rel="nofollow" target="_blank">NetBSD and RISC OS running parallel</a></h3> <blockquote> <p>I have been experimenting with running two systems at the same time on the RK3399 SoC.<br/> It all begun when I figured out how to switch to the A72 cpu for RISC OS. When the switch was done, the A53 cpu just continued to execute code.<br/> OK I thought why not give it something to do!<br/> My first step was to run some small programs.<br/> It worked!</p> <ul> <li>Thanks to Tom Jones for the pointer to this article</li> </ul> </blockquote> <h3>Several weeks ago we covered a story about switching from Linux to BSD.  Benedict and JT asked for community feedback as to their thoughts on the matter.  Allan was out that week, so this will give him an opportunity to chime in with his thoughts as well.</h3> <ul> <li>Jamie - <a href="http://dpaste.com/0CH1YXQ#wrap" rel="nofollow" target="_blank">Dumping Linux for BSD</a></li> <li>Matt - <a href="http://dpaste.com/2N68YPJ#wrap" rel="nofollow" target="_blank">BSD Packaging</a></li> <li>Brad - <a href="http://dpaste.com/2SF9V38#wrap" rel="nofollow" target="_blank">Linux vs BS</a></li> <li>MJ - <a href="http://dpaste.com/0Z2ZT4V#wrap" rel="nofollow" target="_blank">Linux vs BSD Feedback</a></li> <li>Ben - <a href="http://dpaste.com/0B3M85X" rel="nofollow" target="_blank">Feedback for JT</a></li> <li>Henrik - <a href="http://dpaste.com/3F36EQE#wrap" rel="nofollow" target="_blank">Why you should migrate everything to BSD</a></li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.dragonflydigest.com/2020/04/06/24367.html" rel="nofollow" target="_blank">ssh-copy-id now included</a></li> <li><a href="https://opnsense.org/opnsense-20-1-3-released/" rel="nofollow" target="_blank">OPNsense 20.1.3 released</a></li> <li><a href="https://bsd-cloud-image.org/" rel="nofollow" target="_blank">A Collection of prebuilt BSD Cloud Images</a></li> <li><a href="https://tmate.io/" rel="nofollow" target="_blank">Instant terminal sharing</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Ales - <a href="http://dpaste.com/1EBWTK5#wrap" rel="nofollow" target="_blank">Manually verify signature files for pkg package</a></li> <li>Shody - <a href="http://dpaste.com/340PM9Q#wrap" rel="nofollow" target="_blank">Yubikey</a></li> <li>Mike - <a href="http://dpaste.com/13W9SF0" rel="nofollow" target="_blank">Site for hashes from old disks</a> <ul> <li>Answer: <a href="https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing" rel="nofollow" target="_blank">https://docs.google.com/spreadsheets/d/19FmLs0jXxLkxAr0zwgdrXQd1qhbwvNHH6NvolvXKWTM/edit?usp=sharing</a></li> </ul></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p>          Your browser does not support the HTML5 video tag. </p>

Switchers to BSD | BSD Now 345

Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more. Headlines Text processing in the shell  This article is part of a self-published book project by Balthazar Rouberol and Etienne Brodu, ex-roommates, friends and colleagues, aiming at empowering the up and coming generation of developers. We currently are hard at work on it! One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc. When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.  Rebalancing data on ZFS mirrors  One of the questions that comes up time and time again about ZFS is “how can I migrate my data to a pool on a few of my disks, then add the rest of the disks afterward?” If you just want to get the data moved and don’t care about balance, you can just copy the data over, then add the new disks and be done with it. But, it won’t be distributed evenly over the vdevs in your pool. Don’t fret, though, it’s actually pretty easy to rebalance mirrors. In the following example, we’ll assume you’ve got four disks in a RAID array on an old machine, and two disks available to copy the data to in the short term.  News Roundup Using OpenBSD relayd to Add Security Headers  I am a huge fan of OpenBSD’s built-in httpd server as it is simple, secure, and quite performant. With the modern push of the large search providers pushing secure websites, it is now important to add security headers to your website or risk having the search results for your website downgraded. Fortunately, it is very easy to do this when you combine httpd with relayd. While relayd is principally designed for layer 3 redirections and layer 7 relays, it just so happens that it makes a handy tool for adding the recommended security headers. My website automatically redirects users from http to https and this gets achieved using a simple redirection in /etc/httpd.conf So if you have a configuration similar to mine, then you will still want to have httpd listen on the egress interface on port 80. The key thing to change here is to have httpd listen on 127.0.0.1 on port 443.  How we set up our ZFS filesystem hierarchy in our ZFS pools  Our long standing practice here, predating even the first generation of our ZFS fileservers, is that we have two main sorts of filesystems, home directories (homedir filesystems) and what we call 'work directory' (workdir) filesystems. Homedir filesystems are called /h/NNN (for some NNN) and workdir filesystems are called /w/NNN; the NNN is unique across all of the different sorts of filesystems. Users are encouraged to put as much stuff as possible in workdirs and can have as many of them as they want, which mattered a lot more in the days when we used Solaris DiskSuite and had fixed-sized filesystems.  Speeding up ZSH https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh  I was opening multiple shells for an unrelated project today and noticed how abysmal my shell load speed was. After the initial load it was relatively fast, but the actual shell start up was noticeably slow. I timed it with time and these were the results. In the future I hope to actually recompile zsh with additional profiling techniques and debug information - keeping an internal timer and having a flag output current time for each command in a tree fashion would make building heat maps really easy.  How do Unix Pipes work  Pipes are cool! We saw how handy they are in a previous blog post. Let’s look at a typical way to use the pipe operator. We have some output, and we want to look at the first lines of the output. Let’s download The Brothers Karamazov by Fyodor Dostoevsky, a fairly long novel.  What we do to enable us to grow our ZFS pools over time  In my entry on why ZFS isn't good at growing and reshaping pools, I mentioned that we go to quite some lengths in our ZFS environment to be able to incrementally expand our pools. Today I want to put together all of the pieces of that in one place to discuss what those lengths are. Our big constraint is that not only do we need to add space to pools over time, but we have a fairly large number of pools and which pools will have space added to them is unpredictable. We need a solution to pool expansion that leaves us with as much flexibility as possible for as long as possible. This pretty much requires being able to expand pools in relatively small increments of space.  Linux maintains bugs: The real reason ifconfig on Linux is deprecated  In my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).  In the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system. Clear Your Terminal in Style  if you’re someone like me who habitually clears their terminal, sometimes you want a little excitement in your life. Here is a way to do just that. This post revolves around the idea of giving a command a percent chance of running. While the topic at hand is not serious, this simple technique has potential in your scripts.  Feedback/Questions  Guy - AMD GPU Help MLShroyer13 - VLANs and Jails Master One - ZFS Suspend/resume   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv            Your browser does not support the HTML5 video tag. 

<p>Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more.</p> <h2>Headlines</h2> <h3><a href="https://blog.balthazar-rouberol.com/text-processing-in-the-shell" rel="nofollow" target="_blank">Text processing in the shell</a></h3> <blockquote> <p>This article is part of a self-published book project by Balthazar Rouberol and Etienne Brodu, ex-roommates, friends and colleagues, aiming at empowering the up and coming generation of developers. We currently are hard at work on it!</p> <p>One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc.</p> <p>When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.</p> </blockquote> <h3><a href="https://jrs-s.net/2020/03/10/rebalancing-data-on-zfs-mirrors/" rel="nofollow" target="_blank">Rebalancing data on ZFS mirrors</a></h3> <blockquote> <p>One of the questions that comes up time and time again about ZFS is “how can I migrate my data to a pool on a few of my disks, then add the rest of the disks afterward?”</p> <p>If you just want to get the data moved and don’t care about balance, you can just copy the data over, then add the new disks and be done with it. But, it won’t be distributed evenly over the vdevs in your pool.</p> <p>Don’t fret, though, it’s actually pretty easy to rebalance mirrors. In the following example, we’ll assume you’ve got four disks in a RAID array on an old machine, and two disks available to copy the data to in the short term.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://web.archive.org/web/20191109121500/https://goblackcat.com/posts/using-openbsd-relayd-to-add-security-headers/" rel="nofollow" target="_blank">Using OpenBSD relayd to Add Security Headers</a></h3> <blockquote> <p>I am a huge fan of OpenBSD’s built-in httpd server as it is simple, secure, and quite performant. With the modern push of the large search providers pushing secure websites, it is now important to add security headers to your website or risk having the search results for your website downgraded. Fortunately, it is very easy to do this when you combine httpd with relayd. While relayd is principally designed for layer 3 redirections and layer 7 relays, it just so happens that it makes a handy tool for adding the recommended security headers. My website automatically redirects users from http to https and this gets achieved using a simple redirection in /etc/httpd.conf So if you have a configuration similar to mine, then you will still want to have httpd listen on the egress interface on port 80. The key thing to change here is to have httpd listen on 127.0.0.1 on port 443.</p> </blockquote> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSOurContainerFilesystems" rel="nofollow" target="_blank">How we set up our ZFS filesystem hierarchy in our ZFS pools</a></h3> <blockquote> <p>Our long standing practice here, predating even the first generation of our ZFS fileservers, is that we have two main sorts of filesystems, home directories (homedir filesystems) and what we call 'work directory' (workdir) filesystems. Homedir filesystems are called /h/NNN (for some NNN) and workdir filesystems are called /w/NNN; the NNN is unique across all of the different sorts of filesystems. Users are encouraged to put as much stuff as possible in workdirs and can have as many of them as they want, which mattered a lot more in the days when we used Solaris DiskSuite and had fixed-sized filesystems.</p> </blockquote> <h3><a href="https://blog.jonlu.ca/posts/speeding-up-zsh" rel="nofollow" target="_blank">Speeding up ZSH</a></h3> <p><a href="https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh" rel="nofollow" target="_blank">https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh</a></p> <blockquote> <p>I was opening multiple shells for an unrelated project today and noticed how abysmal my shell load speed was. After the initial load it was relatively fast, but the actual shell start up was noticeably slow. I timed it with time and these were the results.</p> <p>In the future I hope to actually recompile zsh with additional profiling techniques and debug information - keeping an internal timer and having a flag output current time for each command in a tree fashion would make building heat maps really easy.</p> </blockquote> <h3><a href="https://www.vegardstikbakke.com/how-do-pipes-work-sigpipe/" rel="nofollow" target="_blank">How do Unix Pipes work</a></h3> <blockquote> <p>Pipes are cool! We saw how handy they are in a previous blog post. Let’s look at a typical way to use the pipe operator. We have some output, and we want to look at the first lines of the output. Let’s download The Brothers Karamazov by Fyodor Dostoevsky, a fairly long novel.</p> </blockquote> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSHowWeGrowPools" rel="nofollow" target="_blank">What we do to enable us to grow our ZFS pools over time</a></h3> <blockquote> <p>In my entry on why ZFS isn't good at growing and reshaping pools, I mentioned that we go to quite some lengths in our ZFS environment to be able to incrementally expand our pools. Today I want to put together all of the pieces of that in one place to discuss what those lengths are.<br/> Our big constraint is that not only do we need to add space to pools over time, but we have a fairly large number of pools and which pools will have space added to them is unpredictable. We need a solution to pool expansion that leaves us with as much flexibility as possible for as long as possible. This pretty much requires being able to expand pools in relatively small increments of space.</p> </blockquote> <h3><a href="https://blog.farhan.codes/2018/06/25/linux-maintains-bugs-the-real-reason-ifconfig-on-linux-is-deprecated/" rel="nofollow" target="_blank">Linux maintains bugs: The real reason ifconfig on Linux is deprecated</a></h3> <blockquote> <p>In my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).</p> </blockquote> <p>In the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system.</p> <h3><a href="https://adammusciano.com/2020/03/04/2020-03-04-clear-your-terminal-in-style/" rel="nofollow" target="_blank">Clear Your Terminal in Style</a></h3> <blockquote> <p>if you’re someone like me who habitually clears their terminal, sometimes you want a little excitement in your life. Here is a way to do just that.</p> <p>This post revolves around the idea of giving a command a percent chance of running. While the topic at hand is not serious, this simple technique has potential in your scripts.</p> </blockquote> <h2>Feedback/Questions</h2> <ul> <li>Guy - <a href="http://dpaste.com/2NEPDHB" rel="nofollow" target="_blank">AMD GPU Help</a></li> <li>MLShroyer13 - <a href="http://dpaste.com/31KBNP4#wrap" rel="nofollow" target="_blank">VLANs and Jails</a></li> <li>Master One - <a href="http://dpaste.com/0DKM8CF#wrap" rel="nofollow" target="_blank">ZFS Suspend/resume</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p>          Your browser does not support the HTML5 video tag. </p>

Grains of Salt | BSD Now 344

Fighting the Coronavirus with FreeBSD, Wireguard VPN Howto in OPNsense, NomadBSD 1.3.1 available, fresh GhostBSD 20.02, New FuryBSD XFCE and KDE images, pf-badhost 0.3 released, and more. Headlines Fighting the Coronavirus with FreeBSD  Here is a quick HOWTO for those who want to provide some FreeBSD based compute resources to help finding vaccines. UPDATE 2020-03-22: 0mp@ made a port out of this, it is in “biology/linux-foldingathome”. Per default it will now pick up some SARS-CoV‑2 (COVID-19) related folding tasks. There are some more config options (e.g. how much of the system resources are used). Please refer to the official Folding@Home site for more information about that. Be also aware that there is a big rise in compute resources donated to Folding@Home, so the pool of available work units may be empty from time to time, but they are working on adding more work units. Be patient.  How to configure the Wireguard VPN in OPNsense  WireGuard is a modern designed VPN that uses the latest cryptography for stronger security, is very lightweight, and is relatively easy to set up (mostly). I say ‘mostly’ because I found setting up WireGuard in OPNsense to be more difficult than I anticipated. The basic setup of the WireGuard VPN itself was as easy as the authors claim on their website, but I came across a few gotcha's. The gotcha's occur with functionality that is beyond the scope of the WireGuard protocol so I cannot fault them for that. My greatest struggle was configuring WireGuard to function similarly to my OpenVPN server. I want the ability to connect remotely to my home network from my iPhone or iPad, tunnel all traffic through the VPN, have access to certain devices and services on my network, and have the VPN devices use my home's Internet connection. WireGuard behaves more like a SSH server than a typical VPN server. With WireGuard, devices which have shared their cryptographic keys with each other are able to connect via an encrypted tunnel (like a SSH server configured to use keys instead of passwords). The devices that are connecting to one another are referred to as “peer” devices. When the peer device is an OPNsense router with WireGuard installed, for instance, it can be configured to allow access to various resources on your network. It becomes a tunnel into your network similar to OpenVPN (with the appropriate firewall rules enabled). I will refer to the WireGuard installation on OPNsense as the server rather than a “peer” to make it more clear which device I am configuring unless I am describing the user interface because that is the terminology used interchangeably by WireGuard. The documentation I found on WireGuard in OPNsense is straightforward and relatively easy to understand, but I had to wrestle with it for a little while to gain a better understanding on how it should be configured. I believe it was partially due to differing end goals – I was trying to achieve something a little different than the authors of other wiki/blog/forum posts. Piecing together various sources of information, I finally ended up with a configuration that met the goals stated above.  News Roundup NomadBSD 1.3.1  NomadBSD 1.3.1 has recently been made available. NomadBSD is a lightweight and portable FreeBSD distribution, designed to run on live on a USB flash drive, allowing you to plug, test, and play on different hardware. They have also started a forum as of yesterday, where you can ask questions and mingle with the NomadBSD community. Notable changes in 1.3.1 are base system upgraded to FreeBSD 12.1-p2. automatic network interface setup improved, image size increased to over 4GB, Thunderbird, Zeroconf, and some more listed below.  GhostBSD 20.02  Eric Turgeon, main developer of GhostBSD, has announced version 20.02 of the FreeBSD based operating system. Notable changes are ZFS partition into the custom partition editor installer, allowing you to install alongside with Windows, Linux, or macOS. Other changes are force upgrade all packages on system upgrade, improved update station, and powerd by default for laptop battery performance.  New FuryBSD XFCE and KDE images  This new release is now based on FreeBSD 12.1 with the latest FreeBSD quarterly packages. This brings XFCE up to 4.14, and KDE up to 5.17. In addition to updates this new ISO mostly addresses community bugs, community enhancement requests, and community pull requests. Due to the overwhelming amount of reports with GitHub hosting all new releases are now being pushed to SourceForge only for the time being. Previous releases will still be kept for archive purposes.  pf-badhost 0.3 Released  pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet's biggest irritants. Annoyances such as SSH and SMTP bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.  Beastie Bits  DragonFly i915 drm update CShell is punk rock The most surprising Unix programs  Feedback/Questions  Master One - Torn between OpenBSD and FreeBSD Brad - Follow up to Linus ZFS story Filipe Carvalho - Call for Portuguese BSD User Groups   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Fighting the Coronavirus with FreeBSD, Wireguard VPN Howto in OPNsense, NomadBSD 1.3.1 available, fresh GhostBSD 20.02, New FuryBSD XFCE and KDE images, pf-badhost 0.3 released, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.leidinger.net/blog/2020/03/19/fighting-the-coronavirus-with-freebsd-foldinghome/" rel="nofollow" target="_blank">Fighting the Coronavirus with FreeBSD</a></h3> <blockquote> <p>Here is a quick HOWTO for those who want to provide some FreeBSD based compute resources to help finding vaccines.</p> <p>UPDATE 2020-03-22: 0mp@ made a port out of this, it is in “biology/linux-foldingathome”.</p> <p>Per default it will now pick up some SARS-CoV‑2 (COVID-19) related folding tasks. There are some more config options (e.g. how much of the system resources are used). Please refer to the official Folding@Home site for more information about that. Be also aware that there is a big rise in compute resources donated to Folding@Home, so the pool of available work units may be empty from time to time, but they are working on adding more work units. Be patient.</p> </blockquote> <h3><a href="https://homenetworkguy.com/how-to/configure-wireguard-opnsense/" rel="nofollow" target="_blank">How to configure the Wireguard VPN in OPNsense</a></h3> <blockquote> <p>WireGuard is a modern designed VPN that uses the latest cryptography for stronger security, is very lightweight, and is relatively easy to set up (mostly). I say ‘mostly’ because I found setting up WireGuard in OPNsense to be more difficult than I anticipated. The basic setup of the WireGuard VPN itself was as easy as the authors claim on their website, but I came across a few gotcha's. The gotcha's occur with functionality that is beyond the scope of the WireGuard protocol so I cannot fault them for that. My greatest struggle was configuring WireGuard to function similarly to my OpenVPN server. I want the ability to connect remotely to my home network from my iPhone or iPad, tunnel all traffic through the VPN, have access to certain devices and services on my network, and have the VPN devices use my home's Internet connection.</p> <p>WireGuard behaves more like a SSH server than a typical VPN server. With WireGuard, devices which have shared their cryptographic keys with each other are able to connect via an encrypted tunnel (like a SSH server configured to use keys instead of passwords). The devices that are connecting to one another are referred to as “peer” devices. When the peer device is an OPNsense router with WireGuard installed, for instance, it can be configured to allow access to various resources on your network. It becomes a tunnel into your network similar to OpenVPN (with the appropriate firewall rules enabled). I will refer to the WireGuard installation on OPNsense as the server rather than a “peer” to make it more clear which device I am configuring unless I am describing the user interface because that is the terminology used interchangeably by WireGuard.</p> <p>The documentation I found on WireGuard in OPNsense is straightforward and relatively easy to understand, but I had to wrestle with it for a little while to gain a better understanding on how it should be configured. I believe it was partially due to differing end goals – I was trying to achieve something a little different than the authors of other wiki/blog/forum posts. Piecing together various sources of information, I finally ended up with a configuration that met the goals stated above.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://nomadbsd.org/index.html#1.3.1" rel="nofollow" target="_blank">NomadBSD 1.3.1</a></h3> <blockquote> <p>NomadBSD 1.3.1 has recently been made available. NomadBSD is a lightweight and portable FreeBSD distribution, designed to run on live on a USB flash drive, allowing you to plug, test, and play on different hardware. They have also started a forum as of yesterday, where you can ask questions and mingle with the NomadBSD community. Notable changes in 1.3.1 are base system upgraded to FreeBSD 12.1-p2. automatic network interface setup improved, image size increased to over 4GB, Thunderbird, Zeroconf, and some more listed below.</p> </blockquote> <h3><a href="https://ghostbsd.org/20.02_release_announcement" rel="nofollow" target="_blank">GhostBSD 20.02</a></h3> <blockquote> <p>Eric Turgeon, main developer of GhostBSD, has announced version 20.02 of the FreeBSD based operating system. Notable changes are ZFS partition into the custom partition editor installer, allowing you to install alongside with Windows, Linux, or macOS. Other changes are force upgrade all packages on system upgrade, improved update station, and powerd by default for laptop battery performance.</p> </blockquote> <h3><a href="https://www.furybsd.org/new-furybsd-12-1-based-images-are-available-for-xfce-and-kde/" rel="nofollow" target="_blank">New FuryBSD XFCE and KDE images</a></h3> <blockquote> <p>This new release is now based on FreeBSD 12.1 with the latest FreeBSD quarterly packages. This brings XFCE up to 4.14, and KDE up to 5.17. In addition to updates this new ISO mostly addresses community bugs, community enhancement requests, and community pull requests. Due to the overwhelming amount of reports with GitHub hosting all new releases are now being pushed to SourceForge only for the time being. Previous releases will still be kept for archive purposes.</p> </blockquote> <h3><a href="https://www.geoghegan.ca/pfbadhost.html" rel="nofollow" target="_blank">pf-badhost 0.3 Released</a></h3> <blockquote> <p>pf-badhost is a simple, easy to use badhost blocker that uses the power of the pf firewall to block many of the internet's biggest irritants. Annoyances such as SSH and SMTP bruteforcers are largely eliminated. Shodan scans and bots looking for webservers to abuse are stopped dead in their tracks. When used to filter outbound traffic, pf-badhost blocks many seedy, spooky malware containing and/or compromised webhosts.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.dragonflydigest.com/2020/03/23/24324.html" rel="nofollow" target="_blank">DragonFly i915 drm update</a></li> <li><a href="http://blog.snailtext.com/posts/cshell-is-punk-rock.html" rel="nofollow" target="_blank">CShell is punk rock</a></li> <li><a href="https://minnie.tuhs.org/pipermail/tuhs/2020-March/020664.html" rel="nofollow" target="_blank">The most surprising Unix programs</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Master One - <a href="http://dpaste.com/102HKF5#wrap" rel="nofollow" target="_blank">Torn between OpenBSD and FreeBSD</a></li> <li>Brad - <a href="http://dpaste.com/1VXQA2Y#wrap" rel="nofollow" target="_blank">Follow up to Linus ZFS story</a></li> <li>Filipe Carvalho - <a href="http://dpaste.com/2H7S8YP" rel="nofollow" target="_blank">Call for Portuguese BSD User Groups</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

FreeBSD, Corona: Fight! | BSD Now 343

OpenBSD Full disk encryption with coreboot and tianocore, FreeBSD 12.0 EOL, ZFS DVA layout, OpenBSD’s Go situation, AD updates requires changes in TrueNAS and FreeNAS, full name of FreeBSD’s root account, and more. Headlines OpenBSD Full Disk Encryption with CoreBoot and Tianocore Payload  It has been a while since I have posted here so I wanted to share something that was surprisingly difficult for me to figure out.  I have a Thinkpad T440p that I have flashed with Coreboot 4.11 with some special patches that allow the newer machine to work.  When I got the laptop, the default BIOS was UEFI and I installed two operating systems. Windows 10 with bitlocker full disk encryption on the “normal” drive (I replaced the spinning 2.5″ disk with an SSD) Ubuntu 19.10 on the m.2 SATA drive that I installed using LUKS full disk encryption I purchased one of those carriers for the optical bay that allows you to install a third SSD and so I did that with the intent of putting OpenBSD on it.  Since my other two operating systems were running full disk encryption, I wanted to do the same on OpenBSD.   See article for rest of story  FreeBSD 12.0 EOL  Dear FreeBSD community, As of February 29, 2020, FreeBSD 12.0 will reach end-of-life and will no longer be supported by the FreeBSD Security Team.  Users of FreeBSD 12.0 are strongly encouraged to upgrade to a newer release as soon as possible.   12.1 Active release 12.2 Release Schedule  News Roundup Some effects of the ZFS DVA format on data layout and growing ZFS pools  One piece of ZFS terminology is DVA and DVAs, which is short for Data Virtual Address. For ZFS, a DVA is the equivalent of a block number in other filesystems; it tells ZFS where to find whatever data we're talking about. The short summary of what fields DVAs have and what they mean is that DVAs tell us how to find blocks by giving us their vdev (by number) and their byte offset into that particular vdev (and then their size). A typical DVA might say that you find what it's talking about on vdev 0 at byte offset 0x53a40ed000. There are some consequences of this that I hadn't really thought about until the other day. Right away we can see why ZFS has a problem removing a vdev; the vdev's number is burned into every DVA that refers to data on it. If there's no vdev 0 in the pool, ZFS has no idea where to even start looking for data because all addressing is relative to the vdev. ZFS pool shrinking gets around this by adding a translation layer that says where to find the portions of vdev 0 that you care about after it's been removed.  Warning! Active Directory Security Changes Require TrueNAS and FreeNAS Updates.  Critical Information for Current FreeNAS and TrueNAS Users   Microsoft is changing the security defaults for Active Directory to eliminate some security vulnerabilities in its protocols. Unfortunately, these new security defaults may disrupt existing FreeNAS/TrueNAS deployments once Windows systems are updated. The Windows updates may appear sometime in March 2020; no official date has been announced as of yet. FreeNAS and TrueNAS users that utilize Active Directory should update to version 11.3 (or 11.2-U8) to avoid potential disruption of their networks when updating to the latest versions of Windows software after March 1, 2020. Version 11.3 has been released and version 11.2-U8 will be available in early March.  Full name of the FreeBSD Root Account  NetBSD now has a users(7) and groups(7) manual. Looking into what entries existed in the passwd and group files I wondered about root’s full name who we now know as Charlie Root in the BSDs....  OpenBSD Go Situation  Over in the fediverse, Pete Zaitcev had a reaction to my entry on OpenBSD versus Prometheus for us: I don't think the situation is usually that bad. Our situation with Prometheus is basically a worst case scenario for Go on OpenBSD, and most people will have much better results, especially if you stick to supported OpenBSD versions. If you stick to supported OpenBSD versions, upgrading your machines as older OpenBSD releases fall out of support (as the OpenBSD people want you to do), you should not have any problems with your own Go programs. The latest Go release will support the currently supported OpenBSD versions (as long as OpenBSD remains a supported platform for Go), and the Go 1.0 compatibility guarantee means that you can always rebuild your current Go programs with newer versions of Go. You might have problems with compiled binaries that you don't want to rebuild, but my understanding is that this is the case for OpenBSD in general; it doesn't guarantee a stable ABI even for C programs (cf). If you use OpenBSD, you have to be prepared to rebuild your code after OpenBSD upgrades regardless of what language it's written in.  Beastie Bits  Test your TOR OPNsense 20.1.1 released pkg for FreeBSD 1.13  Feedback/Questions  Bostjan writes in about Wireguard Charlie has a followup to wpa_supplicant as lower class citizen Lars writes about LibreSSL as a positive example   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>OpenBSD Full disk encryption with coreboot and tianocore, FreeBSD 12.0 EOL, ZFS DVA layout, OpenBSD’s Go situation, AD updates requires changes in TrueNAS and FreeNAS, full name of FreeBSD’s root account, and more.</p> <h2>Headlines</h2> <h3><a href="https://functionallyparanoid.com/2020/03/07/openbsd-full-disk-encryption-with-coreboot-and-tianocore-payload/" rel="nofollow" target="_blank">OpenBSD Full Disk Encryption with CoreBoot and Tianocore Payload</a></h3> <blockquote> <p>It has been a while since I have posted here so I wanted to share something that was surprisingly difficult for me to figure out.  I have a Thinkpad T440p that I have flashed with Coreboot 4.11 with some special patches that allow the newer machine to work.  When I got the laptop, the default BIOS was UEFI and I installed two operating systems.</p> <p>Windows 10 with bitlocker full disk encryption on the “normal” drive (I replaced the spinning 2.5″ disk with an SSD)</p> <p>Ubuntu 19.10 on the m.2 SATA drive that I installed using LUKS full disk encryption</p> <p>I purchased one of those carriers for the optical bay that allows you to install a third SSD and so I did that with the intent of putting OpenBSD on it.  Since my other two operating systems were running full disk encryption, I wanted to do the same on OpenBSD.</p> </blockquote> <ul> <li>See article for rest of story</li> </ul> <h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001930.html" rel="nofollow" target="_blank">FreeBSD 12.0 EOL</a></h3> <blockquote> <p>Dear FreeBSD community,</p> <p>As of February 29, 2020, FreeBSD 12.0 will reach end-of-life and will no longer be supported by the FreeBSD Security Team.  Users of FreeBSD 12.0 are strongly encouraged to upgrade to a newer release as soon as possible.</p> </blockquote> <ul> <li><a href="https://www.freebsd.org/releases/12.1R/announce.html" rel="nofollow" target="_blank">12.1 Active release</a></li> <li><a href="https://www.freebsd.org/releases/12.2R/schedule.html" rel="nofollow" target="_blank">12.2 Release Schedule</a></li> </ul> <h2>News Roundup</h2> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSDVAFormatAndGrowth" rel="nofollow" target="_blank">Some effects of the ZFS DVA format on data layout and growing ZFS pools</a></h3> <blockquote> <p>One piece of ZFS terminology is DVA and DVAs, which is short for Data Virtual Address. For ZFS, a DVA is the equivalent of a block number in other filesystems; it tells ZFS where to find whatever data we're talking about. The short summary of what fields DVAs have and what they mean is that DVAs tell us how to find blocks by giving us their vdev (by number) and their byte offset into that particular vdev (and then their size). A typical DVA might say that you find what it's talking about on vdev 0 at byte offset 0x53a40ed000. There are some consequences of this that I hadn't really thought about until the other day.</p> <p>Right away we can see why ZFS has a problem removing a vdev; the vdev's number is burned into every DVA that refers to data on it. If there's no vdev 0 in the pool, ZFS has no idea where to even start looking for data because all addressing is relative to the vdev. ZFS pool shrinking gets around this by adding a translation layer that says where to find the portions of vdev 0 that you care about after it's been removed.</p> </blockquote> <h3><a href="https://www.ixsystems.com/blog/active-directory-truenas-and-freenas/" rel="nofollow" target="_blank">Warning! Active Directory Security Changes Require TrueNAS and FreeNAS Updates.</a></h3> <ul> <li>Critical Information for Current FreeNAS and TrueNAS Users</li> </ul> <blockquote> <p>Microsoft is changing the security defaults for Active Directory to eliminate some security vulnerabilities in its protocols. Unfortunately, these new security defaults may disrupt existing FreeNAS/TrueNAS deployments once Windows systems are updated. The Windows updates may appear sometime in March 2020; no official date has been announced as of yet.</p> <p>FreeNAS and TrueNAS users that utilize Active Directory should update to version 11.3 (or 11.2-U8) to avoid potential disruption of their networks when updating to the latest versions of Windows software after March 1, 2020. Version 11.3 has been released and version 11.2-U8 will be available in early March.</p> </blockquote> <h3><a href="https://www.geeklan.co.uk/?p=2457" rel="nofollow" target="_blank">Full name of the FreeBSD Root Account</a></h3> <blockquote> <p>NetBSD now has a users(7) and groups(7) manual. Looking into what entries existed in the passwd and group files I wondered about root’s full name who we now know as Charlie Root in the BSDs....</p> </blockquote> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/programming/GoOpenBSDSituation" rel="nofollow" target="_blank">OpenBSD Go Situation</a></h3> <blockquote> <p>Over in the fediverse, Pete Zaitcev had a reaction to my entry on OpenBSD versus Prometheus for us:</p> <p>I don't think the situation is usually that bad. Our situation with Prometheus is basically a worst case scenario for Go on OpenBSD, and most people will have much better results, especially if you stick to supported OpenBSD versions.</p> <p>If you stick to supported OpenBSD versions, upgrading your machines as older OpenBSD releases fall out of support (as the OpenBSD people want you to do), you should not have any problems with your own Go programs. The latest Go release will support the currently supported OpenBSD versions (as long as OpenBSD remains a supported platform for Go), and the Go 1.0 compatibility guarantee means that you can always rebuild your current Go programs with newer versions of Go. You might have problems with compiled binaries that you don't want to rebuild, but my understanding is that this is the case for OpenBSD in general; it doesn't guarantee a stable ABI even for C programs (cf). If you use OpenBSD, you have to be prepared to rebuild your code after OpenBSD upgrades regardless of what language it's written in.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="http://lists.nycbug.org/pipermail/talk/2020-February/018174.html" rel="nofollow" target="_blank">Test your TOR</a></li> <li><a href="https://opnsense.org/opnsense-20-1-1-released/" rel="nofollow" target="_blank">OPNsense 20.1.1 released</a></li> <li><a href="https://svnweb.freebsd.org/ports?view=revision&amp;revision=525794" rel="nofollow" target="_blank">pkg for FreeBSD 1.13</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li><a href="http://dpaste.com/3WKG09D#wrap" rel="nofollow" target="_blank">Bostjan writes in about Wireguard</a></li> <li><a href="http://dpaste.com/0DDN99Q#wrap" rel="nofollow" target="_blank">Charlie has a followup to wpa_supplicant as lower class citizen</a></li> <li><a href="http://dpaste.com/1N12HFB#wrap" rel="nofollow" target="_blank">Lars writes about LibreSSL as a positive example</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

Layout the DVA | BSD Now 342

FreeBSD on Power, DragonflyBSD 5.8 is here, Unifying FreeNAS/TrueNAS, OpenBSD vs. Prometheus and Go, gcc 4.2.1 removed from FreeBSD base, and more. Headlines FreeBSD on Power  The power and promise of all open source software is freedom. Another way to express freedom is choice — choice of platforms, deployment models, stacks, configurations, etc. The FreeBSD Foundation is dedicated to supporting and promoting the FreeBSD Project and community worldwide. But, what does this mean, exactly, you may wonder. The truth is it means many different things, but in all cases the Foundation acts to expand freedom and choice so that FreeBSD users have the power to serve their varied compute needs. This blog tells the story of one specific way the Foundation helps a member of the community provide greater hardware choice for all FreeBSD users.  Dragonfly 5.8  DragonFly version 5.8 brings a new dsynth utility for building your own binary dports packages, plus significant support work to speed up that build - up to and including the entire collection. Additional progress has been made on GPU and signal support. The details of all commits between the 5.6 and 5.8 branches are available in the associated commit messages for 5.8.0rc1 and 5.8.0. Also see /usr/src/UPDATING for specific file changes in PAM.   See article for rest of information  2nd HamBUG meeting recap  The second meeting of the Hamilton BSD Users Group took place last night The next meeting is scheduled for the 2nd Tuesday of the month, April 14th 2020  News Roundup FreeNAS/TrueNAS Brand Unification  FreeNAS and TrueNAS have been separate-but-related members of the #1 Open Source storage software family since 2012. FreeNAS is the free Open Source version with an expert community and has led the pursuit of innovations like Plugins and VMs. TrueNAS is the enterprise version for organizations of all sizes that need additional uptime and performance, as well as the enterprise-grade support necessary for critical data and applications.  From the beginning at iXsystems, we’ve developed, tested, documented, and released both as separate products, even though the vast majority of code is shared. This was a deliberate technical decision in the beginning but over time became less of a necessity and more of “just how we’ve always done it”. Furthermore, to change it was going to require a serious overhaul to how we build and package both products, among other things, so we continued to kick the can down the road. As we made systematic improvements to development and QA efficiency over the past few years, the redundant release process became almost impossible to ignore as our next major efficiency roadblock to overcome. So, we’ve finally rolled up our sleeves. With the recent 11.3 release, TrueNAS gained parity with FreeNAS on features like VMs and Plugins, further homogenizing the code. Today, we announce the next phase of evolution for FreeNAS and TrueNAS.   OpenBSD versus Prometheus (and Go).  We have a decent number of OpenBSD machines that do important things (and that have sometimes experienced problems like running out of disk space), and we have a Prometheus based metrics and monitoring system. The Prometheus host agent has enough support for OpenBSD to be able to report on critical metrics, including things like local disk space. Despite all of this, after some investigation I've determined that it's not really sensible to even try to deploy the host agent on our OpenBSD machines. This is due to a combination of factors that have at their root OpenBSD's lack of ABI stability  FreeBSD removed gcc from base  As described in Warner's email message[1] to the FreeBSD-arch mailing list we have reached GCC 4.2.1's retirement date.  At this time all supported architectures either use in-tree Clang, or rely on external toolchain (i.e., a contemporary GCC version from ports). GCC 4.2.1 was released July 18, 2007 and was imported into FreeBSD later that year, in r171825.  GCC has served us well, but version 4.2.1 is obsolete and not used by default on any architecture in FreeBSD.  It does not support modern C and does not support arm64 or RISC-V.  Beastie Bits  New Archive location for Dragonfly 4.x A dead simple git cheat sheet Xorg 1.20.7 on HardenedBSD Comes with IE/RELRO+BIND_NOW/CFI/SafeStack Protections  Feedback/Questions  Niclas writes in Regarding the Lenovo E595 user (episode 340) Lyubomir writes about GELI and ZFS Peter writes in about scaling FreeBSD jails   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>FreeBSD on Power, DragonflyBSD 5.8 is here, Unifying FreeNAS/TrueNAS, OpenBSD vs. Prometheus and Go, gcc 4.2.1 removed from FreeBSD base, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.freebsdfoundation.org/blog/power-to-the-people-making-freebsd-a-first-class-citizen-on-power/" rel="nofollow" target="_blank">FreeBSD on Power</a></h3> <blockquote> <p>The power and promise of all open source software is freedom. Another way to express freedom is choice — choice of platforms, deployment models, stacks, configurations, etc.</p> <p>The FreeBSD Foundation is dedicated to supporting and promoting the FreeBSD Project and community worldwide. But, what does this mean, exactly, you may wonder. The truth is it means many different things, but in all cases the Foundation acts to expand freedom and choice so that FreeBSD users have the power to serve their varied compute needs.</p> <p>This blog tells the story of one specific way the Foundation helps a member of the community provide greater hardware choice for all FreeBSD users.</p> </blockquote> <h3><a href="https://www.dragonflybsd.org/release58/" rel="nofollow" target="_blank">Dragonfly 5.8</a></h3> <blockquote> <p>DragonFly version 5.8 brings a new dsynth utility for building your own binary dports packages, plus significant support work to speed up that build - up to and including the entire collection. Additional progress has been made on GPU and signal support.</p> <p>The details of all commits between the 5.6 and 5.8 branches are available in the associated commit messages for 5.8.0rc1 and 5.8.0. Also see /usr/src/UPDATING for specific file changes in PAM.</p> </blockquote> <ul> <li>See article for rest of information</li> </ul> <h3><a href="https://www.hambug.ca/" rel="nofollow" target="_blank">2nd HamBUG meeting recap</a></h3> <ul> <li>The second meeting of the Hamilton BSD Users Group took place last night</li> <li>The next meeting is scheduled for the 2nd Tuesday of the month, April 14th 2020</li> </ul> <h2>News Roundup</h2> <h3><a href="https://www.ixsystems.com/blog/freenas-truenas-unification/" rel="nofollow" target="_blank">FreeNAS/TrueNAS Brand Unification</a></h3> <blockquote> <p>FreeNAS and TrueNAS have been separate-but-related members of the #1 Open Source storage software family since 2012. FreeNAS is the free Open Source version with an expert community and has led the pursuit of innovations like Plugins and VMs. TrueNAS is the enterprise version for organizations of all sizes that need additional uptime and performance, as well as the enterprise-grade support necessary for critical data and applications. </p> <p>From the beginning at iXsystems, we’ve developed, tested, documented, and released both as separate products, even though the vast majority of code is shared. This was a deliberate technical decision in the beginning but over time became less of a necessity and more of “just how we’ve always done it”. Furthermore, to change it was going to require a serious overhaul to how we build and package both products, among other things, so we continued to kick the can down the road. As we made systematic improvements to development and QA efficiency over the past few years, the redundant release process became almost impossible to ignore as our next major efficiency roadblock to overcome. So, we’ve finally rolled up our sleeves.</p> <p>With the recent 11.3 release, TrueNAS gained parity with FreeNAS on features like VMs and Plugins, further homogenizing the code. Today, we announce the next phase of evolution for FreeNAS and TrueNAS. </p> </blockquote> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/sysadmin/OpenBSDVsPrometheusAndGo" rel="nofollow" target="_blank">OpenBSD versus Prometheus (and Go).</a></h3> <blockquote> <p>We have a decent number of OpenBSD machines that do important things (and that have sometimes experienced problems like running out of disk space), and we have a Prometheus based metrics and monitoring system. The Prometheus host agent has enough support for OpenBSD to be able to report on critical metrics, including things like local disk space. Despite all of this, after some investigation I've determined that it's not really sensible to even try to deploy the host agent on our OpenBSD machines. This is due to a combination of factors that have at their root OpenBSD's lack of ABI stability</p> </blockquote> <h3><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=358454" rel="nofollow" target="_blank">FreeBSD removed gcc from base</a></h3> <blockquote> <p>As described in Warner's email message[1] to the FreeBSD-arch mailing list we have reached GCC 4.2.1's retirement date.  At this time all supported architectures either use in-tree Clang, or rely on external toolchain (i.e., a contemporary GCC version from ports).</p> <p>GCC 4.2.1 was released July 18, 2007 and was imported into FreeBSD later that year, in r171825.  GCC has served us well, but version 4.2.1 is obsolete and not used by default on any architecture in FreeBSD.  It does not support modern C and does not support arm64 or RISC-V.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.dragonflydigest.com/2020/03/10/24276.html" rel="nofollow" target="_blank">New Archive location for Dragonfly 4.x</a></li> <li><a href="https://hub.iwebthings.com/a-dead-simple-git-cheatsheet/" rel="nofollow" target="_blank">A dead simple git cheat sheet</a></li> <li><a href="https://twitter.com/lattera/status/1233412881569415168" rel="nofollow" target="_blank">Xorg 1.20.7 on HardenedBSD Comes with IE/RELRO+BIND_NOW/CFI/SafeStack Protections</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li><a href="http://dpaste.com/2YJ6PFW#wrap" rel="nofollow" target="_blank">Niclas writes in Regarding the Lenovo E595 user (episode 340)</a></li> <li><a href="http://dpaste.com/1S0DGT3#wrap" rel="nofollow" target="_blank">Lyubomir writes about GELI and ZFS</a></li> <li><a href="http://dpaste.com/2FSZQ8V#wrap" rel="nofollow" target="_blank">Peter writes in about scaling FreeBSD jails</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

U-NAS-ification | BSD Now 341

Why ZFS is doing filesystem checksumming right, better TMPFS throughput performance on DragonFlyBSD, reshaping pools with ZFS, PKGSRC on Manjaro aarch64 Pinebook-pro, central log host with syslog-ng on FreeBSD, and more. Headlines Checksumming in filesystems, and why ZFS is doing it right  One of the best aspects of ZFS is its reliability. This can be accomplished using a few features like copy-on-write approach and checksumming. Today we will look at how ZFS does checksumming and why it does it the proper way. Most of the file systems don’t provide any integrity checking and fail in several scenarios:   Data bit flips - when the data that we wanted to store are bit flipped by the hard drives, or cables, and the wrong data is stored on the hard drive. Misdirected writes - when the CPU/cable/hard drive will bit flip a block to which the data should be written. Misdirected read - when we miss reading the block when a bit flip occurred. Phantom writes - when the write operation never made it to the disk. For example, a disk or kernel may have some bug that it will return success even if the hard drive never made the write. This problem can also occur when data is kept only in the hard drive cache.   Checksumming may help us detect errors in a few of those situations.  DragonFlyBSD Improves Its TMPFS Implementation For Better Throughput Performance  It's been a while since last having any new magical optimizations to talk about by DragonFlyBSD lead developer Matthew Dillon, but on Wednesday he landed some significant temporary file-system "TMPFS" optimizations for better throughput including with swap. Of several interesting commits merged tonight, the improved write clustering is a big one. In particular, "Reduces low-memory tmpfs paging I/O overheads by 4x and generally increases paging throughput to SSD-based swap by 2x-4x. Tmpfs is now able to issue a lot more 64KB I/Os when under memory pressure."   https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860   There's also a new tunable in the VM space as well as part of his commits on Wednesday night. This follows a lot of recent work on dsynth, improved page-out daemon pipelining, and other routine work.   https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351   This work is building up towards the eventual DragonFlyBSD 5.8 while those wanting to try the latest improvements right away can find their daily snapshots.  News Roundup Why ZFS is not good at growing and reshaping pools (or shrinking them)  recently read Mark McBride's Five Years of Btrfs (via), which has a significant discussion of why McBride chose Btrfs over ZFS that boils down to ZFS not being very good at evolving your pool structure. You might doubt this judgment from a Btrfs user, so let me say as both a fan of ZFS and a long term user of it that this is unfortunately quite true; ZFS is not a good choice if you want to modify your pool disk layout significantly over time. ZFS works best if the only change in your pools that you do is replacing drives with bigger drives. In our ZFS environment we go to quite some lengths to be able to expand pools incrementally over time, and while this works it both leaves us with unbalanced pools and means that we're basically forced to use mirroring instead of RAIDZ. (An unbalanced pool is one where some vdevs and disks have much more data than others. This is less of an issue for us now that we're using SSDs instead of HDs.)  Using PKGSRC on Manjaro Linux aarch64 Pinebook-pro  I wanted to see how pkgsrc works on aarch64 Linux Manjaro since it is a very mature framework that is very portable and supported by many architectures – pkgsrc (package source) is a package management system for Unix-like operating systems. It was forked from the FreeBSD ports collection in 1997 as the primary package management system for NetBSD. One might question why use pkgsrc on Arch based Manjaro, since the pacman package repository is very good on its own. I see alternative pkgsrc as a good automated build framework that offers a way to produce independent build environment /usr/pkg that does not interfere with the current Linux distribution in any way (all libraries are statically built) I have used the latest Manjaro for Pinebookpro and standard recommended tools as mentioned here https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/  A Central Log Host with syslog-ng on FreeBSD  Part 1   syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.   Part 2   This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not too difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the SoCruel.NU central log host.  Beastie Bits  FreeBSD at Linux Conf 2020 session videos now online Unlock your laptop with your phone Managing a database of vulnerabilities for a package system: the pkgsrc study Hamilton BSD User group will meet again on March 10th](http://studybsd.com/) CharmBUG Meeting: March 24th 7pm in Severn, MD***  Feedback/Questions  Andrew - ZFS feature Flags Sam - TwinCat BSD Dacian - Freebsd + amdgpu + Lenovo E595   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Why ZFS is doing filesystem checksumming right, better TMPFS throughput performance on DragonFlyBSD, reshaping pools with ZFS, PKGSRC on Manjaro aarch64 Pinebook-pro, central log host with syslog-ng on FreeBSD, and more.</p> <h2>Headlines</h2> <h3><a href="https://oshogbo.vexillium.org/blog/73/" rel="nofollow" target="_blank">Checksumming in filesystems, and why ZFS is doing it right</a></h3> <blockquote> <p>One of the best aspects of ZFS is its reliability. This can be accomplished using a few features like copy-on-write approach and checksumming. Today we will look at how ZFS does checksumming and why it does it the proper way. Most of the file systems don’t provide any integrity checking and fail in several scenarios:</p> </blockquote> <ul> <li>Data bit flips - when the data that we wanted to store are bit flipped by the hard drives, or cables, and the wrong data is stored on the hard drive.</li> <li>Misdirected writes - when the CPU/cable/hard drive will bit flip a block to which the data should be written.</li> <li>Misdirected read - when we miss reading the block when a bit flip occurred.</li> <li>Phantom writes - when the write operation never made it to the disk. For example, a disk or kernel may have some bug that it will return success even if the hard drive never made the write. This problem can also occur when data is kept only in the hard drive cache.</li> </ul> <blockquote> <p>Checksumming may help us detect errors in a few of those situations.</p> </blockquote> <h3><a href="https://www.phoronix.com/scan.php?page=news_item&amp;px=DragonFlyBSD-TMPFS-Throughput" rel="nofollow" target="_blank">DragonFlyBSD Improves Its TMPFS Implementation For Better Throughput Performance</a></h3> <blockquote> <p>It's been a while since last having any new magical optimizations to talk about by DragonFlyBSD lead developer Matthew Dillon, but on Wednesday he landed some significant temporary file-system "TMPFS" optimizations for better throughput including with swap.</p> <p>Of several interesting commits merged tonight, the improved write clustering is a big one. In particular, "Reduces low-memory tmpfs paging I/O overheads by 4x and generally increases paging throughput to SSD-based swap by 2x-4x. Tmpfs is now able to issue a lot more 64KB I/Os when under memory pressure."</p> </blockquote> <ul> <li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860" rel="nofollow" target="_blank">https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/4eb0bb82efc8ef32c4357cf812891c08d38d8860</a></li> </ul> <blockquote> <p>There's also a new tunable in the VM space as well as part of his commits on Wednesday night. This follows a lot of recent work on dsynth, improved page-out daemon pipelining, and other routine work.</p> </blockquote> <ul> <li><a href="https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351" rel="nofollow" target="_blank">https://gitweb.dragonflybsd.org/dragonfly.git/commit/bc47dbc18bf832e4badb41f2fd79159479a7d351</a></li> </ul> <blockquote> <p>This work is building up towards the eventual DragonFlyBSD 5.8 while those wanting to try the latest improvements right away can find their daily snapshots.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSWhyNoRealReshaping" rel="nofollow" target="_blank">Why ZFS is not good at growing and reshaping pools (or shrinking them)</a></h3> <blockquote> <p>recently read Mark McBride's Five Years of Btrfs (via), which has a significant discussion of why McBride chose Btrfs over ZFS that boils down to ZFS not being very good at evolving your pool structure. You might doubt this judgment from a Btrfs user, so let me say as both a fan of ZFS and a long term user of it that this is unfortunately quite true; ZFS is not a good choice if you want to modify your pool disk layout significantly over time. ZFS works best if the only change in your pools that you do is replacing drives with bigger drives. In our ZFS environment we go to quite some lengths to be able to expand pools incrementally over time, and while this works it both leaves us with unbalanced pools and means that we're basically forced to use mirroring instead of RAIDZ.</p> <p>(An unbalanced pool is one where some vdevs and disks have much more data than others. This is less of an issue for us now that we're using SSDs instead of HDs.)</p> </blockquote> <h3><a href="https://astr0baby.wordpress.com/2020/02/09/using-pkgsrc-on-manjaro-linux-aarch64-pinebook-pro/" rel="nofollow" target="_blank">Using PKGSRC on Manjaro Linux aarch64 Pinebook-pro</a></h3> <blockquote> <p>I wanted to see how pkgsrc works on aarch64 Linux Manjaro since it is a very mature framework that is very portable and supported by many architectures – pkgsrc (package source) is a package management system for Unix-like operating systems. It was forked from the FreeBSD ports collection in 1997 as the primary package management system for NetBSD.</p> <p>One might question why use pkgsrc on Arch based Manjaro, since the pacman package repository is very good on its own. I see alternative pkgsrc as a good automated build framework that offers a way to produce independent build environment /usr/pkg that does not interfere with the current Linux distribution in any way (all libraries are statically built)</p> <p>I have used the latest Manjaro for Pinebookpro and standard recommended tools as mentioned here <a href="https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/" rel="nofollow" target="_blank">https://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_linux/</a></p> </blockquote> <h3>A Central Log Host with syslog-ng on FreeBSD</h3> <ul> <li><a href="https://blog.socruel.nu/freebsd/a-central-log-host-with-syslog-ng-on-freebsd.html" rel="nofollow" target="_blank">Part 1</a></li> </ul> <blockquote> <p>syslog-ng is the Swiss army knife of log management. You can collect logs from any source, process them in real time and deliver them to wide range of destinations. It allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure. This is why syslog-ng is the perfect solution for the central log host of my (mainly) FreeBSD based infrastructure.</p> </blockquote> <ul> <li><a href="https://blog.socruel.nu/freebsd/check-logs-of-syslog-ng-log-host-on-freebsd.html" rel="nofollow" target="_blank">Part 2</a></li> </ul> <blockquote> <p>This blog post continues where the blog post A central log host with syslog-ng on FreeBSD left off. Open source solutions to check syslog log messages exist, such as Logcheck or Logwatch. Although these are not too difficult to implement and maintain, I still found these to much. So I went for my own home grown solution to check the syslog messages of the <a href="http://SoCruel.NU" rel="nofollow" target="_blank">SoCruel.NU</a> central log host.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://mirror.linux.org.au/pub/linux.conf.au/2020/room_9/Tuesday/" rel="nofollow" target="_blank">FreeBSD at Linux Conf 2020 session videos now online</a></li> <li><a href="https://vermaden.wordpress.com/2020/01/09/freebsd-desktop-part-20-configuration-unlock-your-laptop-with-phone/" rel="nofollow" target="_blank">Unlock your laptop with your phone</a></li> <li><a href="https://www.netbsd.org/gallery/presentations/leot/itasec20/pkgsrc-security.pdf" rel="nofollow" target="_blank">Managing a database of vulnerabilities for a package system: the pkgsrc study</a></li> <li>Hamilton BSD User group will meet again on March 10th](<a href="http://studybsd.com/" rel="nofollow" target="_blank">http://studybsd.com/</a>)</li> <li><a href="https://www.meetup.com/en-AU/CharmBUG/events/268251508/" rel="nofollow" target="_blank">CharmBUG Meeting: March 24th 7pm in Severn, MD</a><br>***</li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Andrew - <a href="http://dpaste.com/2YM23C0#wrap" rel="nofollow" target="_blank">ZFS feature Flags</a></li> <li>Sam - <a href="http://dpaste.com/0FCZV6R" rel="nofollow" target="_blank">TwinCat BSD</a></li> <li>Dacian - <a href="http://dpaste.com/1R7F1JN#wrap" rel="nofollow" target="_blank">Freebsd + amdgpu + Lenovo E595</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

Check My Sums | BSD Now 340

Meet FuryBSD, NetBSD 9.0 has been released, OpenBSD Foundation 2019 campaign wrapup, a retrospective on OmniOS ZFS-based NFS fileservers, NetBSD Fundraising 2020 goal, OpenSSH 8.2 released, and more.## Headlines Meet FuryBSD: A New Desktop BSD Distribution  At its heart, FuryBSD is a very simple beast. According to the site, “FuryBSD is a back to basics lightweight desktop distribution based on stock FreeBSD.” It is basically FreeBSD with a desktop environment pre-configured and several apps preinstalled. The goal is to quickly get a FreeBSD-based system running on your computer. You might be thinking that this sounds a lot like a couple of other BSDs that are available, such as NomadBSD and GhostBSD. The major difference between those BSDs and FuryBSD is that FuryBSD is much closer to stock FreeBSD. For example, FuryBSD uses the FreeBSD installer, while others have created their own installers and utilities. As it states on the site, “Although FuryBSD may resemble past graphical BSD projects like PC-BSD and TrueOS, FuryBSD is created by a different team and takes a different approach focusing on tight integration with FreeBSD. This keeps overhead low and maintains compatibility with upstream.” The lead dev also told me that “One key focus for FuryBSD is for it to be a small live media with a few assistive tools to test drivers for hardware.” Currently, you can go to the FuryBSD homepage and download either an XFCE or KDE LiveCD. A GNOME version is in the works.  NetBSD 9.0  The NetBSD Project is pleased to announce NetBSD 9.0, the seventeenth major release of the NetBSD operating system. This release brings significant improvements in terms of hardware support, quality assurance, security, along with new features and hundreds of bug fixes. Here are some highlights of this new release.  News Roundup OpenBSD Foundation 2019 campaign wrapup  Our target for 2019 was CDN$300K. Our community's continued generosity combined with our corporate donors exceeded that nicely. In addition we received the largest single donation in our history, CDN$380K from Smartisan. The return of Google was another welcome event. Altogether 2019 was our most successful campaign to date, yielding CDN$692K in total. We thank all our donors, Iridium (Smartisan), Platinum (Yandex, Google), Gold (Microsoft, Facebook) Silver (2Keys) and Bronze (genua, Thinkst Canary). But especially our community of smaller donors whose contributions are the bedrock of our support. Thank you all!   OpenBSD Foundation 2019 Fundraising Goal Exceeded  A retrospective on our OmniOS ZFS-based NFS fileservers  Our OmniOS fileservers have now been out of service for about six months, which makes it somewhat past time for a retrospective on them. Our OmniOS fileservers followed on our Solaris fileservers, which I wrote a two part retrospective on (part 1, part 2), and have now been replaced by our Linux fileservers. To be honest, I have been sitting on my hands about writing this retrospective because we have mixed feelings about our OmniOS fileservers. I will put the summary up front. OmniOS worked reasonably well for us over its lifespan here and looking back I think it was almost certainly the right choice for us at the time we made that choice (which was 2013 and 2014). However it was not without issues that marred our experience with it in practice, although not enough to make me regret that we ran it (and ran it for as long as we did). Part of our issues are likely due to a design mistake in making our fileservers too big, although this design mistake was probably magnified when we were unable to use Intel 10G-T networking in OmniOS. On the one hand, our OmniOS fileservers worked, almost always reliably. Like our Solaris fileservers before them, they ran quietly for years without needing much attention, delivering NFS fileservice to our Ubuntu servers; specifically, we ran them for about five years (2014 through 2019, although we started migrating away at the end of 2018). Over this time we had only minor hardware issues and not all that many disk failures, and we suffered no data loss (with ZFS checksums likely saving us several times, and certainly providing good reassurances). Our overall environment was easy to manage and was pretty much problem free in the face of things like failed disks. I'm pretty sure that our users saw a NFS environment that was solid, reliable, and performed well pretty much all of the time, which is the important thing. So OmniOS basically delivered the fileserver environment we wanted.  NetBSD Fundraising 2020 goal  Is it really more than 10 years since we last had an official fundraising drive? Looking at old TNF financial reports I noticed that we have been doing quite well financially over the last years, with a steady stream of small and medium donations, and most of the time only moderate expenditures. The last fundraising drive back in 2009 was a giant success, and we have lived off it until now.  OpenSSH 8.2 released February 14, 2020  OpenSSH 8.2 was released on 2020-02-14. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support. Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at:   https://www.openssh.com/donations.html  Beastie Bits  FreeNAS vs. Unraid: GRUDGE MATCH! Unix Toolbox Rigs of Rods - OpenBSD Physics Game NYCBug - Dr Vixie Hamilton BSD User group will meet again on March 10th](http://studybsd.com/) BSD Stockholm - Meetup March 3rd 2020  Feedback/Questions  Shirkdog - Question Master One - ZFS + Suspend/resume Micah Roth - ZFS write caching   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Meet FuryBSD, NetBSD 9.0 has been released, OpenBSD Foundation 2019 campaign wrapup, a retrospective on OmniOS ZFS-based NFS fileservers, NetBSD Fundraising 2020 goal, OpenSSH 8.2 released, and more.## Headlines</p> <h3><a href="https://itsfoss.com/furybsd/" rel="nofollow" target="_blank">Meet FuryBSD: A New Desktop BSD Distribution</a></h3> <blockquote> <p>At its heart, FuryBSD is a very simple beast. According to the site, “FuryBSD is a back to basics lightweight desktop distribution based on stock FreeBSD.” It is basically FreeBSD with a desktop environment pre-configured and several apps preinstalled. The goal is to quickly get a FreeBSD-based system running on your computer.</p> <p>You might be thinking that this sounds a lot like a couple of other BSDs that are available, such as NomadBSD and GhostBSD. The major difference between those BSDs and FuryBSD is that FuryBSD is much closer to stock FreeBSD. For example, FuryBSD uses the FreeBSD installer, while others have created their own installers and utilities.</p> <p>As it states on the site, “Although FuryBSD may resemble past graphical BSD projects like PC-BSD and TrueOS, FuryBSD is created by a different team and takes a different approach focusing on tight integration with FreeBSD. This keeps overhead low and maintains compatibility with upstream.” The lead dev also told me that “One key focus for FuryBSD is for it to be a small live media with a few assistive tools to test drivers for hardware.”</p> <p>Currently, you can go to the FuryBSD homepage and download either an XFCE or KDE LiveCD. A GNOME version is in the works.</p> </blockquote> <h3><a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html" rel="nofollow" target="_blank">NetBSD 9.0</a></h3> <blockquote> <p>The NetBSD Project is pleased to announce NetBSD 9.0, the seventeenth major release of the NetBSD operating system.</p> <p>This release brings significant improvements in terms of hardware support, quality assurance, security, along with new features and hundreds of bug fixes. Here are some highlights of this new release.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="http://undeadly.org/cgi?action=article;sid=20200217001107" rel="nofollow" target="_blank">OpenBSD Foundation 2019 campaign wrapup</a></h3> <blockquote> <p>Our target for 2019 was CDN$300K. Our community's continued generosity combined with our corporate donors exceeded that nicely. In addition we received the largest single donation in our history, CDN$380K from Smartisan. The return of Google was another welcome event. Altogether 2019 was our most successful campaign to date, yielding CDN$692K in total.</p> <p>We thank all our donors, Iridium (Smartisan), Platinum (Yandex, Google), Gold (Microsoft, Facebook) Silver (2Keys) and Bronze (genua, Thinkst Canary). But especially our community of smaller donors whose contributions are the bedrock of our support. Thank you all!</p> </blockquote> <ul> <li><a href="https://www.openbsdfoundation.org/campaign2019.html" rel="nofollow" target="_blank">OpenBSD Foundation 2019 Fundraising Goal Exceeded</a></li> </ul> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/OmniOSFileserverRetrospective" rel="nofollow" target="_blank">A retrospective on our OmniOS ZFS-based NFS fileservers</a></h3> <blockquote> <p>Our OmniOS fileservers have now been out of service for about six months, which makes it somewhat past time for a retrospective on them. Our OmniOS fileservers followed on our Solaris fileservers, which I wrote a two part retrospective on (part 1, part 2), and have now been replaced by our Linux fileservers. To be honest, I have been sitting on my hands about writing this retrospective because we have mixed feelings about our OmniOS fileservers.</p> <p>I will put the summary up front. OmniOS worked reasonably well for us over its lifespan here and looking back I think it was almost certainly the right choice for us at the time we made that choice (which was 2013 and 2014). However it was not without issues that marred our experience with it in practice, although not enough to make me regret that we ran it (and ran it for as long as we did). Part of our issues are likely due to a design mistake in making our fileservers too big, although this design mistake was probably magnified when we were unable to use Intel 10G-T networking in OmniOS.</p> <p>On the one hand, our OmniOS fileservers worked, almost always reliably. Like our Solaris fileservers before them, they ran quietly for years without needing much attention, delivering NFS fileservice to our Ubuntu servers; specifically, we ran them for about five years (2014 through 2019, although we started migrating away at the end of 2018). Over this time we had only minor hardware issues and not all that many disk failures, and we suffered no data loss (with ZFS checksums likely saving us several times, and certainly providing good reassurances). Our overall environment was easy to manage and was pretty much problem free in the face of things like failed disks. I'm pretty sure that our users saw a NFS environment that was solid, reliable, and performed well pretty much all of the time, which is the important thing. So OmniOS basically delivered the fileserver environment we wanted.</p> </blockquote> <h3><a href="http://blog.netbsd.org/tnf/entry/fundraising_2020" rel="nofollow" target="_blank">NetBSD Fundraising 2020 goal</a></h3> <blockquote> <p>Is it really more than 10 years since we last had an official fundraising drive?</p> <p>Looking at old TNF financial reports I noticed that we have been doing quite well financially over the last years, with a steady stream of small and medium donations, and most of the time only moderate expenditures. The last fundraising drive back in 2009 was a giant success, and we have lived off it until now.</p> </blockquote> <h3><a href="http://www.openssh.com/txt/release-8.2" rel="nofollow" target="_blank">OpenSSH 8.2 released February 14, 2020</a></h3> <blockquote> <p>OpenSSH 8.2 was released on 2020-02-14. It is available from the mirrors listed at <a href="https://www.openssh.com/" rel="nofollow" target="_blank">https://www.openssh.com/</a>.</p> <p>OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support.</p> <p>Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at:</p> </blockquote> <ul> <li><a href="https://www.openssh.com/donations.html" rel="nofollow" target="_blank">https://www.openssh.com/donations.html</a></li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.youtube.com/watch?v=aXsRIrC5bjg" rel="nofollow" target="_blank">FreeNAS vs. Unraid: GRUDGE MATCH!</a></li> <li><a href="http://cb.vu/unixtoolbox.xhtml" rel="nofollow" target="_blank">Unix Toolbox</a></li> <li><a href="https://docs.rigsofrods.org/" rel="nofollow" target="_blank">Rigs of Rods - OpenBSD Physics Game</a></li> <li><a href="http://dpaste.com/0V35MAB#wrap" rel="nofollow" target="_blank">NYCBug - Dr Vixie</a></li> <li>Hamilton BSD User group will meet again on March 10th](<a href="http://studybsd.com/" rel="nofollow" target="_blank">http://studybsd.com/</a>)</li> <li><a href="https://www.meetup.com/BSD-Users-Stockholm/events/267873938/" rel="nofollow" target="_blank">BSD Stockholm - Meetup March 3rd 2020</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Shirkdog - <a href="http://dpaste.com/36E2BZ1" rel="nofollow" target="_blank">Question</a></li> <li>Master One - <a href="http://dpaste.com/3B9M814#wrap" rel="nofollow" target="_blank">ZFS + Suspend/resume</a></li> <li>Micah Roth - <a href="http://dpaste.com/0D4GDX1#wrap" rel="nofollow" target="_blank">ZFS write caching</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

BSD Fundraising | BSD Now 339

Distrowatch reviews FuryBSD, LLDB on i386 for NetBSD, wpa_supplicant as lower-class citizen, KDE on FreeBSD updates, Travel Grant for BSDCan open, ZFS dataset for testing iocage within a jail, and more. Headlines Distrowatch Fury BSD Review  FuryBSD is the most recent addition to the DistroWatch database and provides a live desktop operating system based on FreeBSD. FuryBSD is not entirely different in its goals from NomadBSD, which we discussed recently. I wanted to take this FreeBSD-based project for a test drive and see how it compares to NomadBSD and other desktop-oriented projects in the FreeBSD family. FuryBSD supplies hybrid ISO/USB images which can be used to run a live desktop. There are two desktop editions currently, both for 64-bit (x86_64) machines: Xfce and KDE Plasma. The Xfce edition is 1.4GB in size and is the flavour I downloaded. The KDE Plasma edition is about 3.0GB in size. My fresh install of FuryBSD booted to a graphical login screen. From there I could sign into my account, which brings up the Xfce desktop. The installed version of Xfce is the same as the live version, with a few minor changes. Most of the desktop icons have been removed with just the file manager launchers remaining. The Getting Started and System Information icons have been removed. Otherwise the experience is virtually identical to the live media. FuryBSD uses a theme that is mostly grey and white with creamy yellow folder icons. The application menu launchers tend to have neutral icons, neither particularly bright and detailed or minimal.  LLDB now works on i386  Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages. In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support. The original NetBSD port of LLDB was focused on amd64 only. In January, I have extended it to support i386 executables. This includes both 32-bit builds of LLDB (running natively on i386 kernel or via compat32) and debugging 32-bit programs from 64-bit LLDB.  News Roundup wpa_supplicant is definitely a lower-class citizen, sorry  wpa_supplicant is definitely a lower-class citizen, sorry. I increasingly wonder why this stuff matters; transit costs are so much lower than the period when eduroam was setup, and their reliance on 802.11x is super weird in a world where, for the most part     + entire cities have open wifi in their downtown core     + edu vs edu+transit split horizon problems have to be solved anyways     + many universities have parallel open wifi     + rate limiting / fare-share approaches for the open-net, on unmetered     + flat-rate solves the problem     + LTE hotspot off a phone isn't a rip off anymore     + other open networks exist essentially no one else feels compelled to do use 802.11x for a so called "semi-open access network", so I think they've lost the plot on friction vs benefit. (we've held hackathons at EDU campus that are locked down like that, and in every case we've said no way, gotten a wire with open net, and built our own wifi.  we will not subject our developers to that extra complexity).  KDE FreeBSD Updates Feb 2020  Some bits and bobs from the KDE FreeBSD team in february 2020. We met at the FreeBSD devsummit before FOSDEM, along with other FreeBSD people. Plans were made, schemes were forged, and Groff the Goat was introduced to some new people.    The big ticket things:    Frameworks are at 5.66 Plasma is at 5.17.5 (the beta 5.18 hasn’t been tried) KDE release service has landed 19.12.2 (same day it was released)  Developer-centric:   KDevelop is at 5.5.0 KUserfeedback landed its 1.0.0 release CMake is 3.16.3  Applications:   Musescore is at 3.4.2 Elisa now part of the KDE release service updates  Fuure work:   KIO-Fuse probably needs extra real-world testing on FreeBSD. I don’t have that kind of   mounts (just NFS in /etc/fstab) so I’m not the target audience. KTextEditor is missing .editorconfig support. That can come in with the next frameworks update, when consumers update anyway. Chasing it in an intermediate release is a bit problematic because it does require some rebuilds of consumers.   Travel Grant Application for BSDCan is now open  Hi everyone, The Travel Grant Application for BSDCan 2020 is now open. The Foundation can help you attend BSDCan through our travel grant program. Travel grants are available to FreeBSD developers and advocates who need assistance with travel expenses for attending conferences related to FreeBSD development. BSDCan 2020 applications are due April 9, 2020. Find out more and apply at: https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/ Did you know the Foundation also provides grants for technical events not specifically focused on BSD? If you feel that your attendance at one of these events will benefit the FreeBSD Project and Community and you need assistance getting there,  please fill out the general travel grant application.  Your application must be received 7 weeks prior to the event. The general application can be found here: https://goo.gl/forms/QzsOMR8Jra0vqFYH2  Creating a ZFS dataset for testing iocage within a jail  Be warned, this failed. I’m stalled and I have not completed this.   I’m going to do jails within a jail. I already do that with poudriere in a jail but here I want to test an older version of iocage before upgrading my current jail hosts to a newer version.   In this post:   FreeBSD 12.1 py36-iocage-1.2_3 py36-iocage-1.2_4    This post includes my errors and mistakes. Perhaps you should proceed carefully and read it all first.  Beastie Bits  Reminder: the FreeBSD Journal is free! Check out these great articles Serenity GUI desktop running on an OpenBSD kernel The Open Source Parts of MacOS FOSDEM videos available  Feedback/Questions  Michael - Install with ZFS Mohammad - Server Freeze Todd - ZFS Questions   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv            Your browser does not support the HTML5 video tag. 

<p>Distrowatch reviews FuryBSD, LLDB on i386 for NetBSD, wpa_supplicant as lower-class citizen, KDE on FreeBSD updates, Travel Grant for BSDCan open, ZFS dataset for testing iocage within a jail, and more.</p> <h2>Headlines</h2> <h3><a href="https://distrowatch.com/weekly.php?issue=20200127#furybsd" rel="nofollow" target="_blank">Distrowatch Fury BSD Review</a></h3> <blockquote> <p>FuryBSD is the most recent addition to the DistroWatch database and provides a live desktop operating system based on FreeBSD. FuryBSD is not entirely different in its goals from NomadBSD, which we discussed recently. I wanted to take this FreeBSD-based project for a test drive and see how it compares to NomadBSD and other desktop-oriented projects in the FreeBSD family.</p> <p>FuryBSD supplies hybrid ISO/USB images which can be used to run a live desktop. There are two desktop editions currently, both for 64-bit (x86_64) machines: Xfce and KDE Plasma. The Xfce edition is 1.4GB in size and is the flavour I downloaded. The KDE Plasma edition is about 3.0GB in size.</p> <p>My fresh install of FuryBSD booted to a graphical login screen. From there I could sign into my account, which brings up the Xfce desktop. The installed version of Xfce is the same as the live version, with a few minor changes. Most of the desktop icons have been removed with just the file manager launchers remaining. The Getting Started and System Information icons have been removed. Otherwise the experience is virtually identical to the live media.</p> <p>FuryBSD uses a theme that is mostly grey and white with creamy yellow folder icons. The application menu launchers tend to have neutral icons, neither particularly bright and detailed or minimal.</p> </blockquote> <h3><a href="http://blog.netbsd.org/tnf/entry/lldb_now_works_on_i386" rel="nofollow" target="_blank">LLDB now works on i386</a></h3> <blockquote> <p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p> <p>In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.</p> <p>The original NetBSD port of LLDB was focused on amd64 only. In January, I have extended it to support i386 executables. This includes both 32-bit builds of LLDB (running natively on i386 kernel or via compat32) and debugging 32-bit programs from 64-bit LLDB.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://marc.info/?l=openbsd-misc&amp;m=158068418807352&amp;w=2" rel="nofollow" target="_blank">wpa_supplicant is definitely a lower-class citizen, sorry</a></h3> <blockquote> <p>wpa_supplicant is definitely a lower-class citizen, sorry.</p> <p>I increasingly wonder why this stuff matters; transit costs are so much lower than the period when eduroam was setup, and their reliance on 802.11x is super weird in a world where, for the most part<br/>     + entire cities have open wifi in their downtown core<br/>     + edu vs edu+transit split horizon problems have to be solved anyways<br/>     + many universities have parallel open wifi<br/>     + rate limiting / fare-share approaches for the open-net, on unmetered<br/>     + flat-rate solves the problem<br/>     + LTE hotspot off a phone isn't a rip off anymore<br/>     + other open networks exist</p> <p>essentially no one else feels compelled to do use 802.11x for a so called "semi-open access network", so I think they've lost the plot on friction vs benefit.</p> <p>(we've held hackathons at EDU campus that are locked down like that, and in every case we've said no way, gotten a wire with open net, and built our own wifi.  we will not subject our developers to that extra complexity).</p> </blockquote> <h3><a href="https://euroquis.nl/freebsd/2020/02/08/freebsd.html" rel="nofollow" target="_blank">KDE FreeBSD Updates Feb 2020</a></h3> <blockquote> <p>Some bits and bobs from the KDE FreeBSD team in february 2020. We met at the FreeBSD devsummit before FOSDEM, along with other FreeBSD people. Plans were made, schemes were forged, and Groff the Goat was introduced to some new people. </p> </blockquote> <ul> <li>The big ticket things:  <ul> <li> Frameworks are at 5.66</li> <li>Plasma is at 5.17.5 (the beta 5.18 hasn’t been tried)</li> <li>KDE release service has landed 19.12.2 (same day it was released)</li> </ul></li> <li>Developer-centric:  <ul> <li>KDevelop is at 5.5.0</li> <li>KUserfeedback landed its 1.0.0 release</li> <li>CMake is 3.16.3</li> </ul></li> <li>Applications:  <ul> <li>Musescore is at 3.4.2</li> <li>Elisa now part of the KDE release service updates</li> </ul></li> <li>Fuure work:  <ul> <li>KIO-Fuse probably needs extra real-world testing on FreeBSD. I don’t have that kind of   mounts (just NFS in /etc/fstab) so I’m not the target audience.</li> <li>KTextEditor is missing .editorconfig support. That can come in with the next frameworks update, when consumers update anyway. Chasing it in an intermediate release is a bit problematic because it does require some rebuilds of consumers.</li> </ul></li> </ul> <h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-February/001929.html" rel="nofollow" target="_blank">Travel Grant Application for BSDCan is now open</a></h3> <blockquote> <p>Hi everyone,</p> <p>The Travel Grant Application for BSDCan 2020 is now open. The Foundation can help you attend BSDCan through our travel grant program. Travel grants are available to FreeBSD developers and advocates who need assistance with travel expenses for attending conferences related to FreeBSD development. BSDCan 2020 applications are due April 9, 2020. Find out more and apply at: <a href="https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/" rel="nofollow" target="_blank">https://www.freebsdfoundation.org/what-we-do/grants/travel-grants/</a></p> <p>Did you know the Foundation also provides grants for technical events not specifically focused on BSD? If you feel that your attendance at one of these events will benefit the FreeBSD Project and Community and you need assistance getting there,  please fill out the general travel grant application.  Your application must be received 7 weeks prior to the event. The general application can be found here: <a href="https://goo.gl/forms/QzsOMR8Jra0vqFYH2" rel="nofollow" target="_blank">https://goo.gl/forms/QzsOMR8Jra0vqFYH2</a></p> </blockquote> <h3><a href="https://dan.langille.org/2020/02/01/creating-a-zfs-dataset-for-testing-iocage-within-a-jail/" rel="nofollow" target="_blank">Creating a ZFS dataset for testing iocage within a jail</a></h3> <ul> <li>Be warned, this failed. I’m stalled and I have not completed this.</li> </ul> <blockquote> <p>I’m going to do jails within a jail. I already do that with poudriere in a jail but here I want to test an older version of iocage before upgrading my current jail hosts to a newer version.</p> </blockquote> <ul> <li>In this post:  <ul> <li>FreeBSD 12.1</li> <li>py36-iocage-1.2_3</li> <li>py36-iocage-1.2_4</li> </ul></li> </ul> <blockquote> <p>This post includes my errors and mistakes. Perhaps you should proceed carefully and read it all first.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.freebsdfoundation.org/journal/browser-based-edition/" rel="nofollow" target="_blank">Reminder: the FreeBSD Journal is free! Check out these great articles</a></li> <li><a href="https://twitter.com/jcs/status/1224205573656322048" rel="nofollow" target="_blank">Serenity GUI desktop running on an OpenBSD kernel</a></li> <li><a href="https://github.com/apple-open-source/macos" rel="nofollow" target="_blank">The Open Source Parts of MacOS</a></li> <li><a href="https://www.fosdem.org/2020/schedule/track/bsd/" rel="nofollow" target="_blank">FOSDEM videos available</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Michael - <a href="http://dpaste.com/3WRC9CQ#wrap" rel="nofollow" target="_blank">Install with ZFS</a></li> <li>Mohammad - <a href="http://dpaste.com/3BYZKMS#wrap" rel="nofollow" target="_blank">Server Freeze</a></li> <li>Todd - <a href="http://dpaste.com/2J50HSJ#wrap" rel="nofollow" target="_blank">ZFS Questions</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p>          Your browser does not support the HTML5 video tag. </p>

iocage in Jail | BSD Now 338

Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more. Headlines The happinesses and stresses of full-time FOSS work  In the past few days, several free software maintainers have come out to discuss the stresses of their work. Though the timing was suggestive, my article last week on the philosophy of project governance was, at best, only tangentially related to this topic - I had been working on that article for a while. I do have some thoughts that I’d like to share about what kind of stresses I’ve dealt with as a FOSS maintainer, and how I’ve managed (or often mismanaged) it. February will mark one year that I’ve been working on self-directed free software projects full-time. I was planning on writing an optimistic retrospective article around this time, but given the current mood of the ecosystem I think it would be better to be realistic. In this stage of my career, I now feel at once happier, busier, more fulfilled, more engaged, more stressed, and more depressed than I have at any other point in my life. The good parts are numerous. I’m able to work on my life’s passions, and my projects are in the best shape they’ve ever been thanks to the attention I’m able to pour into them. I’ve also been able to do more thoughtful, careful work; with the extra time I’ve been able to make my software more robust and reliable than it’s ever been. The variety of projects I can invest my time into has also increased substantially, with what was once relegated to minor curiosities now receiving a similar amount of attention as my larger projects were receiving in my spare time before. I can work from anywhere in the world, at any time, not worrying about when to take time off and when to put my head down and crank out a lot of code. The frustrations are numerous, as well. I often feel like I’ve bit off more than I can chew. This has been the default state of affairs for me for a long time; I’m often neglecting half of my projects in order to obtain progress by leaps and bounds in just a few. Working on FOSS full-time has cast this model’s disadvantages into greater relief, as I focus on a greater breadth of projects and spend more time on them.  Building a FreeBSD File Server  Recently at my job, I was faced with a task to develop a file server explicitly suited for the requirements of the company. Needless to say, any configuration of a kind depends on what the infrastructure needs. So, drawing from my personal experience and numerous materials on the web, I came up with the combination FreeBSD+SAMBA+AD as the most appropriate. It appears to be a perfect choice for this environment, and harmonic addition to the existing network configuration since FreeBSD + SAMBA + AD enables admins with the broad range of possibilities for access control. However, as nothing is perfect, this configuration isn’t the best choice if your priority is data protection because it won’t be able to reach the necessary levels of reliability and fault tolerance without outside improvements. Now, since we’ve established that, let’s move on to the next point. This article’s describing the process of building a test environment while concentrating primarily on the details of the configuration. As the author, though, I must say I’m in no way suggesting that this is the only way! The following configuration will be presented in its initial stage, with the minimum requirements necessary to get the job done, and its purpose in one specific situation only. Here, look at this as a useful strategy to solve similar tasks. Well, let’s get started!  Report from the first Hamilton BSD Users Group Meeting  February 11th was the first meeting of this new user group, founded by John Young and myself 11 people attended, and a lot of good discussions were had One of the attendees already owns a domain that fits well for the group, so we will be getting that setup over the next few weeks, as well as the twitter account, and other organization stuff. Special thanks to the illumos users who drove in from Buffalo to attend, although they may have actually had a shorter drive than a few of the other attendees. The next meeting is scheduled again for the 2nd Tuesday of the month, March 10th. We are still discussing if we should meet at a restaurant again, or try to get a space at the local college or innovation hub where we can have a projector etc.  News Roundup Kubernetes on FreeBSD Bhyve  There are quite a few solutions for container orchestration, but the most popular (or the most famous and highly advertised, is probably, a Kubernetes) Since I plan to conduct many experiments with installing and configuring k8s, I need a laboratory in which I can quickly and easily deploy a cluster in any quantities for myself. In my work and everyday life I use two OS very tightly - Linux and FreeBSD OS. Kubernetes and docker are Linux-centric projects, and at first glance, you should not expect any useful participation and help from FreeBSD here. As the saying goes, an elephant can be made out of a fly, but it will no longer fly. However, two tempting things come to mind - this is very good integration and work in the FreeBSD ZFS file system, from which it would be nice to use the snapshot mechanism, COW and reliability. And the second is the bhyve hypervisor, because we still need the docker and k8s loader in the form of the Linux kernel. Thus, we need to connect a certain number of actions in various ways, most of which are related to starting and pre-configuring virtual machines. This is typical of both a Linux-based server and FreeBSD. What exactly will work under the hood to run virtual machines does not play a big role. And if so - let's take a FreeBSD here!  NetBSD 9 RC1 Available  We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).   Here are a few highlights of the new release:  Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady" compliant machines (SBBR+SBSA) Enhanced hardware support for Armv7-A Updated GPU drivers (e.g. support for Intel Kabylake) Enhanced virtualization support Support for hardware-accelerated virtualization (NVMM) Support for Performance Monitoring Counters Support for Kernel ASLR Support several kernel sanitizers (KLEAK, KASAN, KUBSAN) Support for userland sanitizers Audit of the network stack Many improvements in NPF Updated ZFS Reworked error handling and NCQ support in the SATA subsystem Support a common framework for USB Ethernet drivers (usbnet)  You can download binaries of NetBSD 9.0_RC1 from our Fastly-provided CDN: https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/  OPNsense 20.1 Keen Kingfisher released  For over 5 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing. 20.1, nicknamed "Keen Kingfisher", is a subtle improvement on sustainable firewall experience. This release adds VXLAN and additional loopback device support, IPsec public key authentication and elliptic curve TLS certificate creation amongst others. Third party software has been updated to their latest versions. The logging frontend was rewritten for MVC with seamless API support. On the far side the documentation increased in quality as well as quantity and now presents itself in a familiar menu layout.  Idealistic Future for HardenedBSD  Over the past month, we purchased and deployed the new 13-CURRENT/amd64 package building server. We published our first 13-CURRENT/amd64 production package build using that server. We then rebuilt the old package building server to act as the 12-STABLE/amd64 package building server. This post signifies a very important milestone: we have now fully recovered from last year's death of our infrastructure. Our 12-STABLE/amd64 repo, previously out-of-date by many months, is now fully up-to-date! HardenedBSD is in a very unique position to provide innovative solutions to at-risk and underprivileged populations. As such, we are making human rights endeavors a defining area of focus. Our infrastructure will integrate various privacy and anonymity enhancing technologies and techniques to protect lives. Our operating system's security posture will increase, especially with our focus on exploit mitigations. Navigating the intersection between human rights and information security directly impacts lives. HardenedBSD's 2020 mission and focus is to deliver an entire hardened ecosystem that is unfriendly towards those who would oppress or censor their people. This includes a subtle shift in priorities to match this new mission and focus. While we implement exploit mitigations and further harden the ecosystem, we will seek out opportunities to contribute a tangible and unique impact on human rights issues. Providing Tor Onion Services for our core infrastructure is the first step in likely many to come towards securely helping those in need.  Beastie Bits  Warner Losh's FOSDEM talk Relational Pipes v0.15 A reminder for where to find NetBSD ARM images New Safe Memory Reclamation feature in UMA BSD Users Stockholm Meetup  Feedback/Questions  ZFS - Rosetta Stone Document? Pat - Question Sigflup - Wayland on the BSDs   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more.</p> <h2>Headlines</h2> <h3><a href="https://drewdevault.com//2020/01/21/Stress-and-happiness.html" rel="nofollow" target="_blank">The happinesses and stresses of full-time FOSS work</a></h3> <blockquote> <p>In the past few days, several free software maintainers have come out to discuss the stresses of their work. Though the timing was suggestive, my article last week on the philosophy of project governance was, at best, only tangentially related to this topic - I had been working on that article for a while. I do have some thoughts that I’d like to share about what kind of stresses I’ve dealt with as a FOSS maintainer, and how I’ve managed (or often mismanaged) it.</p> <p>February will mark one year that I’ve been working on self-directed free software projects full-time. I was planning on writing an optimistic retrospective article around this time, but given the current mood of the ecosystem I think it would be better to be realistic. In this stage of my career, I now feel at once happier, busier, more fulfilled, more engaged, more stressed, and more depressed than I have at any other point in my life.</p> <p>The good parts are numerous. I’m able to work on my life’s passions, and my projects are in the best shape they’ve ever been thanks to the attention I’m able to pour into them. I’ve also been able to do more thoughtful, careful work; with the extra time I’ve been able to make my software more robust and reliable than it’s ever been. The variety of projects I can invest my time into has also increased substantially, with what was once relegated to minor curiosities now receiving a similar amount of attention as my larger projects were receiving in my spare time before. I can work from anywhere in the world, at any time, not worrying about when to take time off and when to put my head down and crank out a lot of code.</p> <p>The frustrations are numerous, as well. I often feel like I’ve bit off more than I can chew. This has been the default state of affairs for me for a long time; I’m often neglecting half of my projects in order to obtain progress by leaps and bounds in just a few. Working on FOSS full-time has cast this model’s disadvantages into greater relief, as I focus on a greater breadth of projects and spend more time on them.</p> </blockquote> <h3><a href="https://www.vmwareblog.org/building-freebsd-file-server/" rel="nofollow" target="_blank">Building a FreeBSD File Server</a></h3> <blockquote> <p>Recently at my job, I was faced with a task to develop a file server explicitly suited for the requirements of the company. Needless to say, any configuration of a kind depends on what the infrastructure needs. So, drawing from my personal experience and numerous materials on the web, I came up with the combination FreeBSD+SAMBA+AD as the most appropriate. It appears to be a perfect choice for this environment, and harmonic addition to the existing network configuration since FreeBSD + SAMBA + AD enables admins with the broad range of possibilities for access control. However, as nothing is perfect, this configuration isn’t the best choice if your priority is data protection because it won’t be able to reach the necessary levels of reliability and fault tolerance without outside improvements.</p> <p>Now, since we’ve established that, let’s move on to the next point. This article’s describing the process of building a test environment while concentrating primarily on the details of the configuration. As the author, though, I must say I’m in no way suggesting that this is the only way! The following configuration will be presented in its initial stage, with the minimum requirements necessary to get the job done, and its purpose in one specific situation only. Here, look at this as a useful strategy to solve similar tasks. Well, let’s get started!</p> </blockquote> <h3><a href="https://twitter.com/hambug_ca/status/1227664949914349569" rel="nofollow" target="_blank">Report from the first Hamilton BSD Users Group Meeting</a></h3> <blockquote> <p>February 11th was the first meeting of this new user group, founded by John Young and myself</p> <p>11 people attended, and a lot of good discussions were had</p> <p>One of the attendees already owns a domain that fits well for the group, so we will be getting that setup over the next few weeks, as well as the twitter account, and other organization stuff.</p> <p>Special thanks to the illumos users who drove in from Buffalo to attend, although they may have actually had a shorter drive than a few of the other attendees.</p> <p>The next meeting is scheduled again for the 2nd Tuesday of the month, March 10th.</p> <p>We are still discussing if we should meet at a restaurant again, or try to get a space at the local college or innovation hub where we can have a projector etc.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://www.bsdstore.ru/en/articles/cbsd_k8s_part1.html" rel="nofollow" target="_blank">Kubernetes on FreeBSD Bhyve</a></h3> <blockquote> <p>There are quite a few solutions for container orchestration, but the most popular (or the most famous and highly advertised, is probably, a Kubernetes) Since I plan to conduct many experiments with installing and configuring k8s, I need a laboratory in which I can quickly and easily deploy a cluster in any quantities for myself. In my work and everyday life I use two OS very tightly - Linux and FreeBSD OS. Kubernetes and docker are Linux-centric projects, and at first glance, you should not expect any useful participation and help from FreeBSD here. As the saying goes, an elephant can be made out of a fly, but it will no longer fly. However, two tempting things come to mind - this is very good integration and work in the FreeBSD ZFS file system, from which it would be nice to use the snapshot mechanism, COW and reliability. And the second is the bhyve hypervisor, because we still need the docker and k8s loader in the form of the Linux kernel. Thus, we need to connect a certain number of actions in various ways, most of which are related to starting and pre-configuring virtual machines. This is typical of both a Linux-based server and FreeBSD. What exactly will work under the hood to run virtual machines does not play a big role. And if so - let's take a FreeBSD here!</p> </blockquote> <h3><a href="http://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd" rel="nofollow" target="_blank">NetBSD 9 RC1 Available</a></h3> <blockquote> <p>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</p> </blockquote> <ul> <li><p>Here are a few highlights of the new release:</p> <ul> <li>Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady" compliant machines (SBBR+SBSA)</li> <li>Enhanced hardware support for Armv7-A</li> <li>Updated GPU drivers (e.g. support for Intel Kabylake)</li> <li>Enhanced virtualization support</li> <li>Support for hardware-accelerated virtualization (NVMM)</li> <li>Support for Performance Monitoring Counters</li> <li>Support for Kernel ASLR</li> <li>Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)</li> <li>Support for userland sanitizers</li> <li>Audit of the network stack</li> <li>Many improvements in NPF</li> <li>Updated ZFS</li> <li>Reworked error handling and NCQ support in the SATA subsystem</li> <li>Support a common framework for USB Ethernet drivers (usbnet)</li> </ul></li> <li><p>You can download binaries of NetBSD 9.0_RC1 from our Fastly-provided CDN: <a href="https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/" rel="nofollow" target="_blank">https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/</a></p></li> </ul> <h3><a href="https://opnsense.org/opnsense-20-1-keen-kingfisher-released/" rel="nofollow" target="_blank">OPNsense 20.1 Keen Kingfisher released</a></h3> <blockquote> <p>For over 5 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.</p> <p>20.1, nicknamed "Keen Kingfisher", is a subtle improvement on sustainable firewall experience. This release adds VXLAN and additional loopback device support, IPsec public key authentication and elliptic curve TLS certificate creation amongst others. Third party software has been updated to their latest versions. The logging frontend was rewritten for MVC with seamless API support. On the far side the documentation increased in quality as well as quantity and now presents itself in a familiar menu layout.</p> </blockquote> <h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-01-26/idealistic-future-hardenedbsd" rel="nofollow" target="_blank">Idealistic Future for HardenedBSD</a></h3> <blockquote> <p>Over the past month, we purchased and deployed the new 13-CURRENT/amd64 package building server. We published our first 13-CURRENT/amd64 production package build using that server. We then rebuilt the old package building server to act as the 12-STABLE/amd64 package building server. This post signifies a very important milestone: we have now fully recovered from last year's death of our infrastructure. Our 12-STABLE/amd64 repo, previously out-of-date by many months, is now fully up-to-date!</p> <p>HardenedBSD is in a very unique position to provide innovative solutions to at-risk and underprivileged populations. As such, we are making human rights endeavors a defining area of focus. Our infrastructure will integrate various privacy and anonymity enhancing technologies and techniques to protect lives. Our operating system's security posture will increase, especially with our focus on exploit mitigations.</p> <p>Navigating the intersection between human rights and information security directly impacts lives. HardenedBSD's 2020 mission and focus is to deliver an entire hardened ecosystem that is unfriendly towards those who would oppress or censor their people. This includes a subtle shift in priorities to match this new mission and focus. While we implement exploit mitigations and further harden the ecosystem, we will seek out opportunities to contribute a tangible and unique impact on human rights issues. Providing Tor Onion Services for our core infrastructure is the first step in likely many to come towards securely helping those in need.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://fosdem.org/2020/interviews/warner-losh/" rel="nofollow" target="_blank">Warner Losh's FOSDEM talk</a></li> <li><a href="https://relational-pipes.globalcode.info/v_0/release-v0.15.xhtml" rel="nofollow" target="_blank">Relational Pipes v0.15</a></li> <li><a href="http://www.armbsd.org/arm/" rel="nofollow" target="_blank">A reminder for where to find NetBSD ARM images</a></li> <li><a href="https://lists.freebsd.org/pipermail/freebsd-arch/2020-January/019866.html" rel="nofollow" target="_blank">New Safe Memory Reclamation feature in UMA</a></li> <li><a href="https://twitter.com/niclaszeising/status/1216667359831842817" rel="nofollow" target="_blank">BSD Users Stockholm Meetup</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>ZFS - <a href="http://dpaste.com/13EK8YH#wrap" rel="nofollow" target="_blank">Rosetta Stone Document?</a></li> <li>Pat - <a href="http://dpaste.com/2DN5RA4#wrap" rel="nofollow" target="_blank">Question</a></li> <li>Sigflup - <a href="http://dpaste.com/03Y4FQ7#wrap" rel="nofollow" target="_blank">Wayland on the BSDs</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

Kubernetes on bhyve | BSD Now 337

Linux couldn’t duplicate OpenBSD, FreeBSD Q4 status report, OPNsense 19.7.9 released, archives retain and pass on knowledge, HardenedBSD Tor Onion Service v3 Nodes, and more. Headlines OpenBSD has to be a BSD Unix and you couldn't duplicate it with Linux  OpenBSD has a well deserved reputation for putting security and a clean system (for code, documentation, and so on) first, and everything else second. OpenBSD is of course based on BSD (it's right there in the name) and descends from FreeBSD NetBSD (you can read the history here). But one of the questions you could ask about it is whether it had to be that way, and in particular if you could build something like OpenBSD on top of Linux. I believe that the answer is no. Linux and the *BSDs have a significantly different model of what they are. BSDs have a 'base system' that provides an integrated and fully operational core Unix, covering the kernel, C library and compiler, and the normal Unix user level programs, all maintained and distributed by the particular BSD. Linux is not a single unit this way, and instead all of the component parts are maintained separately and assembled in various ways by various Linux distributions. Both approaches have their advantages, but one big one for the BSD approach is that it enables global changes. Making global changes is an important part of what makes OpenBSD's approach to improving security, code maintenance, and so on work. Because it directly maintains everything as a unit, OpenBSD is in a position to introduce new C library or kernel APIs (or change them) and then immediately update all sorts of things in user level programs to use the new API. This takes a certain amount of work, of course, but it's possible to do it at all. And because OpenBSD can do this sort of ambitious global change, it does. This goes further than just the ability to make global changes, because in theory you can patch in global changes on top of a bunch of separate upstream projects. Because OpenBSD is in control of its entire base system, it's not forced to try to reconcile different development priorities or integrate clashing changes. OpenBSD can decide (and has) that only certain sorts of changes will be accepted into its system at all, no matter what people want. If there are features or entire programs that don't fit into what OpenBSD will accept, they just lose out.  FreeBSD Quarterly Status Report 2019Q4  Here is the last quarterly status report for 2019. As you might remember from last report, we changed our timeline: now we collect reports the last month of each quarter and we edit and publish the full document the next month. Thus, we cover here the period October 2019 - December 2019. If you thought that the FreeBSD community was less active in the Christmas' quarter you will be glad to be proven wrong: a quick glance at the summary will be sufficient to see that much work has been done in the last months. Have a nice read!  News Roundup OPNsense 19.7.9 released  As 20.1 nears we will be making adjustments to the scope of the release with an announcement following shortly. For now, this update brings you a GeoIP database configuration page for aliases which is now required due to upstream database policy changes and a number of prominent third-party software updates we are happy to see included.  Archives are important to retain and pass on knowledge  Archives are important. When they are public and available for searching, it retains and passes on knowledge. It saves vast amounts of time.  HardenedBSD Tor Onion Service v3 Nodes  I've been working today on deploying Tor Onion Service v3 nodes across our build infrastructure. I'm happy to announce that the public portion of this is now completed. Below you will find various onion service hostnames and their match to our infrastructure.   hardenedbsd.org: lkiw4tmbudbr43hbyhm636sarn73vuow77czzohdbqdpjuq3vdzvenyd.onion ci-01.nyi.hardenedbsd.org: qspcqclhifj3tcpojsbwoxgwanlo2wakti2ia4wozxjcldkxmw2yj3yd.onion ci-03.md.hardenedbsd.org: eqvnohly4tjrkpwatdhgptftabpesofirnhz5kq7jzn4zd6ernpvnpqd.onion ci-04.md.hardenedbsd.org: rfqabq2w65nhdkukeqwf27r7h5xfh53h3uns6n74feeyl7s5fbjxczqd.onion git-01.md.hardenedbsd.org: dacxzjk3kq5mmepbdd3ai2ifynlzxsnpl2cnkfhridqfywihrfftapid.onion  Beastie Bits  The Missing Semester of Your CS Education (MIT Course) An old Unix Ad OpenBSD syscall call-from verification OpenBSD/arm64 on Pinebook Reminder: First Southern Ontario BSD user group meeting, February 11th (this coming Tuesday!) 18:30 at Boston Pizza on Upper James st, Hamilton. NYCBUG: March meeting will feature Dr. Paul Vixie and his new talk “Operating Systems as Dumb Pipes” 8th Meetup of the Stockholm BUG: March 3 at 18:00 Polish BSD User Group meets on Feb 11, 2020 at 18:15  Feedback/Questions  Sean - ZFS and Creation Dates Christopher - Help on ZFS Disaster Recovery Mike - Encrypted ZFS Send   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Linux couldn’t duplicate OpenBSD, FreeBSD Q4 status report, OPNsense 19.7.9 released, archives retain and pass on knowledge, HardenedBSD Tor Onion Service v3 Nodes, and more.</p> <h2>Headlines</h2> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/unix/OpenBSDMustBeABSD?showcomments" rel="nofollow" target="_blank">OpenBSD has to be a BSD Unix and you couldn't duplicate it with Linux</a></h3> <blockquote> <p>OpenBSD has a well deserved reputation for putting security and a clean system (for code, documentation, and so on) first, and everything else second. OpenBSD is of course based on BSD (it's right there in the name) and descends from FreeBSD NetBSD (you can read the history here). But one of the questions you could ask about it is whether it had to be that way, and in particular if you could build something like OpenBSD on top of Linux. I believe that the answer is no.</p> <p>Linux and the *BSDs have a significantly different model of what they are. BSDs have a 'base system' that provides an integrated and fully operational core Unix, covering the kernel, C library and compiler, and the normal Unix user level programs, all maintained and distributed by the particular BSD. Linux is not a single unit this way, and instead all of the component parts are maintained separately and assembled in various ways by various Linux distributions. Both approaches have their advantages, but one big one for the BSD approach is that it enables global changes.</p> <p>Making global changes is an important part of what makes OpenBSD's approach to improving security, code maintenance, and so on work. Because it directly maintains everything as a unit, OpenBSD is in a position to introduce new C library or kernel APIs (or change them) and then immediately update all sorts of things in user level programs to use the new API. This takes a certain amount of work, of course, but it's possible to do it at all. And because OpenBSD can do this sort of ambitious global change, it does.</p> <p>This goes further than just the ability to make global changes, because in theory you can patch in global changes on top of a bunch of separate upstream projects. Because OpenBSD is in control of its entire base system, it's not forced to try to reconcile different development priorities or integrate clashing changes. OpenBSD can decide (and has) that only certain sorts of changes will be accepted into its system at all, no matter what people want. If there are features or entire programs that don't fit into what OpenBSD will accept, they just lose out.</p> </blockquote> <h3><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2020-January/001923.html" rel="nofollow" target="_blank">FreeBSD Quarterly Status Report 2019Q4</a></h3> <blockquote> <p>Here is the last quarterly status report for 2019. As you might remember from last report, we changed our timeline: now we collect reports the last month of each quarter and we edit and publish the full document the next month. Thus, we cover here the period October 2019 - December 2019.</p> <p>If you thought that the FreeBSD community was less active in the Christmas' quarter you will be glad to be proven wrong: a quick glance at the summary will be sufficient to see that much work has been done in the last months.</p> <p>Have a nice read!</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://opnsense.org/opnsense-19-7-9-released/" rel="nofollow" target="_blank">OPNsense 19.7.9 released</a></h3> <blockquote> <p>As 20.1 nears we will be making adjustments to the scope of the release with an announcement following shortly.</p> <p>For now, this update brings you a GeoIP database configuration page for aliases which is now required due to upstream database policy changes and a number of prominent third-party software updates we are happy to see included.</p> </blockquote> <h3><a href="https://dan.langille.org/2020/01/07/archives-are-important-to-retain-and-pass-on-knowledge/" rel="nofollow" target="_blank">Archives are important to retain and pass on knowledge</a></h3> <blockquote> <p>Archives are important. When they are public and available for searching, it retains and passes on knowledge. It saves vast amounts of time.</p> </blockquote> <h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-01-30/hardenedbsd-tor-onion-service-v3-nodes" rel="nofollow" target="_blank">HardenedBSD Tor Onion Service v3 Nodes</a></h3> <blockquote> <p>I've been working today on deploying Tor Onion Service v3 nodes across our build infrastructure. I'm happy to announce that the public portion of this is now completed. Below you will find various onion service hostnames and their match to our infrastructure.</p> </blockquote> <ul> <li><a href="http://hardenedbsd.org" rel="nofollow" target="_blank">hardenedbsd.org</a>: lkiw4tmbudbr43hbyhm636sarn73vuow77czzohdbqdpjuq3vdzvenyd.onion</li> <li><a href="http://ci-01.nyi.hardenedbsd.org" rel="nofollow" target="_blank">ci-01.nyi.hardenedbsd.org</a>: qspcqclhifj3tcpojsbwoxgwanlo2wakti2ia4wozxjcldkxmw2yj3yd.onion</li> <li><a href="http://ci-03.md.hardenedbsd.org" rel="nofollow" target="_blank">ci-03.md.hardenedbsd.org</a>: eqvnohly4tjrkpwatdhgptftabpesofirnhz5kq7jzn4zd6ernpvnpqd.onion</li> <li><a href="http://ci-04.md.hardenedbsd.org" rel="nofollow" target="_blank">ci-04.md.hardenedbsd.org</a>: rfqabq2w65nhdkukeqwf27r7h5xfh53h3uns6n74feeyl7s5fbjxczqd.onion</li> <li><a href="http://git-01.md.hardenedbsd.org" rel="nofollow" target="_blank">git-01.md.hardenedbsd.org</a>: dacxzjk3kq5mmepbdd3ai2ifynlzxsnpl2cnkfhridqfywihrfftapid.onion</li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://missing.csail.mit.edu/" rel="nofollow" target="_blank">The Missing Semester of Your CS Education (MIT Course)</a></li> <li><a href="https://i.redd.it/503390rf7md41.png" rel="nofollow" target="_blank">An old Unix Ad</a></li> <li><a href="https://marc.info/?l=openbsd-tech&amp;m=157488907117170&amp;w=2" rel="nofollow" target="_blank">OpenBSD syscall call-from verification</a></li> <li><a href="https://twitter.com/bluerise/status/1220963106563579909" rel="nofollow" target="_blank">OpenBSD/arm64 on Pinebook</a></li> <li><a href="http://studybsd.com/" rel="nofollow" target="_blank">Reminder: First Southern Ontario BSD user group meeting, February 11th (this coming Tuesday!) 18:30 at Boston Pizza on Upper James st, Hamilton.</a></li> <li><a href="https://www.nycbug.org/" rel="nofollow" target="_blank">NYCBUG: March meeting will feature Dr. Paul Vixie and his new talk “Operating Systems as Dumb Pipes”</a></li> <li><a href="https://www.meetup.com/de-DE/BSD-Users-Stockholm/events/267873938/" rel="nofollow" target="_blank">8th Meetup of the Stockholm BUG: March 3 at 18:00</a></li> <li><a href="https://bsd-pl.org/en" rel="nofollow" target="_blank">Polish BSD User Group meets on Feb 11, 2020 at 18:15</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Sean - <a href="http://dpaste.com/3W5WBV0#wrap" rel="nofollow" target="_blank">ZFS and Creation Dates</a></li> <li>Christopher - <a href="http://dpaste.com/3SE43PW" rel="nofollow" target="_blank">Help on ZFS Disaster Recovery</a></li> <li>Mike - <a href="http://dpaste.com/00J5JZG#wrap" rel="nofollow" target="_blank">Encrypted ZFS Send</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

Archived Knowledge | BSD Now 336

Hyperbola Developer interview, why you should migrate from Linux to BSD, FreeBSD is an amazing OS, improving the ptrace(2) API in LLVM 10, First FreeBSD conference in Australia, and a guide to containers on FreeNAS. Headlines FreeBSD is an amazing operating System  Update 2020-01-21: Since I wrote this article it got posted on Hacker News, Reddit and Lobster, and a few people have emailed me with comments. I have updated the article with comments where I have found it needed. As an important side note I would like to point out that I am not a FreeBSD developer, there may be things going on in the FreeBSD world that I know absolutely nothing about. I am also not glued to the FreeBSD developer mailing lists. I am not a FreeBSD "fanboy". I have been using GNU/Linux a ton more for the past two decades than FreeBSD, mainly due to hardware incompatibility (lacking or buggy drivers), and I love both Debian GNU/Linux and Arch Linux just as much as FreeBSD. However, I am concerned about the development of GNU/Linux as of late. Also this article is not about me trying to make anyone switch from something else to FreeBSD. It's about why I like FreeBSD and that I recommend you try it out if you're into messing with operating systems. I think the year was late 1999 or mid 2000 when I one day was browsing computer books at my favorite bookshop and I discovered the book The Complete FreeBSD third edition from 1999 by Greg Lehey. With the book came 4 CD Roms with FreeBSD 3.3. I had already familiarized myself with GNU/Linux in 1998, and I was in the process of migrating every server and desktop operating system away from Microsoft Windows, both at home and at my company, to GNU/Linux, initially Red Hat Linux and then later Debian GNU/Linux, which eventually became my favorite GNU/Linux distribution for many years. When I first saw The Complete FreeBSD book by Greg Lehey I remember noticing the text on the front page that said, "The Free Version of Berkeley UNIX" and "Rock Solid Stability", and I was immediately intrigued! What was that all about? A free UNIX operating system! And rock solid stability? That sounded amazing.  Hyperbola Dev Interview  In late December 2019, Hyperbola announced that they would be making major changes to their project. They have decided to drop the Linux kernel in favor of forking the OpenBSD kernel. This announcement only came months after Project Trident announced that they were going in the opposite direction (from BSD to Linux). Hyperbola also plans to replace all software that is not GPL v3 compliant with new versions that are. To get more insight into the future of their new project, I interviewed Andre, co-founder of Hyperbola.  News Roundup Improving the ptrace(2) API and preparing for LLVM-10.0  This month I have improved the NetBSD ptrace(2) API, removing one legacy interface with a few flaws and replacing it with two new calls with new features, and removing technical debt. As LLVM 10.0 is branching now soon (Jan 15th 2020), I worked on proper support of the LLVM features for NetBSD 9.0 (today RC1) and NetBSD HEAD (future 10.0).  The first FreeBSD conference in Australia  FreeBSD has existed as an operating system, project, and foundation for more than twenty years, and its earlier incantations have exited for far longer. The old guard have been developing code, porting software, and writing documentation for longer than I’ve existed. I’ve been using it for more than a decade for personal projects, and professionally for half that time. While there are many prominent Australian FreeBSD contributors, sysadmins, and users, we’ve always had to venture overseas for conferences. We’re always told Australians are among the most ardent travellers, but I always wondered if we could do a domestic event as well. And on Tuesday, we did! Deb Goodkin and the FreeBSD Foundation graciously organised and chaired a dedicated FreeBSD miniconf at the long-running linux.conf.au event held each year in a different city in Australia and New Zealand.  A practical guide to containers on FreeNAS for a depraved psychopath  This is a simple write-up to setup Docker on FreeNAS 11 or FreeBSD 11.  But muh jails?  You know that jails are dope and you know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years…   So jails are dead then?  No, jails are still dope, but jails lack tools to manage them. Yes, there are a few tools, but they meant for hard-core FreeBSD users who used to suffering. Docker allows you to run applications without deep knowledge of application you’re running. It will also allow you to run applications that are not ported to FreeBSD.  Why you should migrate everything from Linux to BSD  As an operating system GNU/Linux has become a real mess because of the fragmented nature of the project, the bloatware in the kernel, and because of the jerking around by commercial interests.   Response Should you migrate from Linux to BSD? It depends.  Beastie Bits  Using the OpenBSD ports tree with dedicated users broot on FreeBSD A Trip down Memory Lane Running syslog-ng in BastilleBSD NASA : Using Software Packages in pkgsrc  Feedback/Questions  All of our questions this week were pretty technical in nature so I'm going to save those for the next episode so Allan can weigh in on them, since if we cover them now we're basically going to be deferring to Allan anyway.   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Hyperbola Developer interview, why you should migrate from Linux to BSD, FreeBSD is an amazing OS, improving the ptrace(2) API in LLVM 10, First FreeBSD conference in Australia, and a guide to containers on FreeNAS.</p> <h2>Headlines</h2> <h3><a href="https://www.unixsheikh.com/articles/freebsd-is-an-amazing-operating-system.html" rel="nofollow" target="_blank">FreeBSD is an amazing operating System</a></h3> <blockquote> <p>Update 2020-01-21: Since I wrote this article it got posted on Hacker News, Reddit and Lobster, and a few people have emailed me with comments. I have updated the article with comments where I have found it needed. As an important side note I would like to point out that I am not a FreeBSD developer, there may be things going on in the FreeBSD world that I know absolutely nothing about. I am also not glued to the FreeBSD developer mailing lists. I am not a FreeBSD "fanboy". I have been using GNU/Linux a ton more for the past two decades than FreeBSD, mainly due to hardware incompatibility (lacking or buggy drivers), and I love both Debian GNU/Linux and Arch Linux just as much as FreeBSD. However, I am concerned about the development of GNU/Linux as of late. Also this article is not about me trying to make anyone switch from something else to FreeBSD. It's about why I like FreeBSD and that I recommend you try it out if you're into messing with operating systems.</p> <p>I think the year was late 1999 or mid 2000 when I one day was browsing computer books at my favorite bookshop and I discovered the book The Complete FreeBSD third edition from 1999 by Greg Lehey. With the book came 4 CD Roms with FreeBSD 3.3.</p> <p>I had already familiarized myself with GNU/Linux in 1998, and I was in the process of migrating every server and desktop operating system away from Microsoft Windows, both at home and at my company, to GNU/Linux, initially Red Hat Linux and then later Debian GNU/Linux, which eventually became my favorite GNU/Linux distribution for many years.</p> <p>When I first saw The Complete FreeBSD book by Greg Lehey I remember noticing the text on the front page that said, "The Free Version of Berkeley UNIX" and "Rock Solid Stability", and I was immediately intrigued! What was that all about? A free UNIX operating system! And rock solid stability? That sounded amazing.</p> </blockquote> <h3><a href="https://itsfoss.com/hyperbola-linux-bsd/" rel="nofollow" target="_blank">Hyperbola Dev Interview</a></h3> <blockquote> <p>In late December 2019, Hyperbola announced that they would be making major changes to their project. They have decided to drop the Linux kernel in favor of forking the OpenBSD kernel. This announcement only came months after Project Trident announced that they were going in the opposite direction (from BSD to Linux).</p> <p>Hyperbola also plans to replace all software that is not GPL v3 compliant with new versions that are.</p> <p>To get more insight into the future of their new project, I interviewed Andre, co-founder of Hyperbola.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://blog.netbsd.org/tnf/entry/improving_the_ptrace_2_api" rel="nofollow" target="_blank">Improving the ptrace(2) API and preparing for LLVM-10.0</a></h3> <blockquote> <p>This month I have improved the NetBSD ptrace(2) API, removing one legacy interface with a few flaws and replacing it with two new calls with new features, and removing technical debt.</p> <p>As LLVM 10.0 is branching now soon (Jan 15th 2020), I worked on proper support of the LLVM features for NetBSD 9.0 (today RC1) and NetBSD HEAD (future 10.0).</p> </blockquote> <h3><a href="https://rubenerd.com/the-first-freebsd-conference-in-australia/" rel="nofollow" target="_blank">The first FreeBSD conference in Australia</a></h3> <blockquote> <p>FreeBSD has existed as an operating system, project, and foundation for more than twenty years, and its earlier incantations have exited for far longer. The old guard have been developing code, porting software, and writing documentation for longer than I’ve existed. I’ve been using it for more than a decade for personal projects, and professionally for half that time.</p> <p>While there are many prominent Australian FreeBSD contributors, sysadmins, and users, we’ve always had to venture overseas for conferences. We’re always told Australians are among the most ardent travellers, but I always wondered if we could do a domestic event as well.</p> <p>And on Tuesday, we did! Deb Goodkin and the FreeBSD Foundation graciously organised and chaired a dedicated FreeBSD miniconf at the long-running <a href="http://linux.conf.au" rel="nofollow" target="_blank">linux.conf.au</a> event held each year in a different city in Australia and New Zealand.</p> </blockquote> <h3><a href="https://medium.com/@andoriyu/a-practical-guide-to-containers-on-freenas-for-a-depraved-psychopath-c212203c0394" rel="nofollow" target="_blank">A practical guide to containers on FreeNAS for a depraved psychopath</a></h3> <blockquote> <p>This is a simple write-up to setup Docker on FreeNAS 11 or FreeBSD 11.</p> </blockquote> <p>But muh jails?</p> <blockquote> <p>You know that jails are dope and you know that jails are dope, yet no one else knows it. So here we are stuck with docker. Two years ago I would be the last person to recommend using docker, but a whole lot of things has changes past years… </p> </blockquote> <p>So jails are dead then?</p> <blockquote> <p>No, jails are still dope, but jails lack tools to manage them. Yes, there are a few tools, but they meant for hard-core FreeBSD users who used to suffering. Docker allows you to run applications without deep knowledge of application you’re running. It will also allow you to run applications that are not ported to FreeBSD.</p> </blockquote> <h3><a href="https://www.unixsheikh.com/articles/why-you-should-migrate-everything-from-linux-to-bsd.html" rel="nofollow" target="_blank">Why you should migrate everything from Linux to BSD</a></h3> <blockquote> <p>As an operating system GNU/Linux has become a real mess because of the fragmented nature of the project, the bloatware in the kernel, and because of the jerking around by commercial interests.</p> </blockquote> <ul> <li>Response <a href="https://fediverse.blog/%7E/AllGoodThings/should-you-migrate-from-linux-to-bsd-it-depends" rel="nofollow" target="_blank">Should you migrate from Linux to BSD? It depends.</a></li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://dataswamp.org/%7Esolene/2020-01-11-privsep.html" rel="nofollow" target="_blank">Using the OpenBSD ports tree with dedicated users</a></li> <li><a href="https://vermaden.wordpress.com/2020/01/10/run-broot-on-freebsd/" rel="nofollow" target="_blank">broot on FreeBSD</a></li> <li><a href="https://svnweb.freebsd.org/base/head/share/misc/bsd-family-tree?view=co" rel="nofollow" target="_blank">A Trip down Memory Lane</a></li> <li><a href="https://www.syslog-ng.com/community/b/blog/posts/running-syslog-ng-in-bastillebsd" rel="nofollow" target="_blank">Running syslog-ng in BastilleBSD</a></li> <li><a href="https://www.nas.nasa.gov/hecc/support/kb/using-software-packages-in-pkgsrc_493.html" rel="nofollow" target="_blank">NASA : Using Software Packages in pkgsrc</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>All of our questions this week were pretty technical in nature so I'm going to save those for the next episode so Allan can weigh in on them, since if we cover them now we're basically going to be deferring to Allan anyway.</li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

FreeBSD Down Under | BSD Now 335

Upgrading FreeBSD from 11.3 to 12.1, Distrowatch switching to FreeBSD, Torvalds says don’t run ZFS, iked(8) removed automatic IPv6 blocking, working towards LLDB on i386, and memory-hard Argon2 hashing scheme in NetBSD. Headlines Upgrading FreeBSD from 11.3 to 12.1  Now here’s something more like what I was originally expecting the content on this blog to look like. I’m in the process of moving all of our FreeBSD servers (about 30 in total) from 11.3 to 12.1. We have our own local build of the OS, and until “packaged base” gets to a state where it’s reliably usable, we’re stuck doing upgrades the old-fashioned way. I created a set of notes for myself while cranking through these upgrades and I wanted to share them since they are not really work-specific and this process isn’t very well documented for people who haven’t been doing this sort of upgrade process for 25 years. Our source and object trees are read-only exported from the build server over NFS, which causes things to be slow. /etc/make.conf and /etc/src.conf are symbolic links on all of our servers to the master copies in /usr/src so that make installworld can find the configuration parameters the system was built with.  Switching Distrowatch over to BSD  This may be a little off-topic for this board (forgive me if it is, please). However, I wanted to say that I'm one of the people who works on DistroWatch (distrowatch.com) and this past week we had to deal with a server facing hardware failure. We had a discussion about whether to continue running Debian or switch to something else. The primary "something else" option turned out to be FreeBSD and it is what we eventually went with. It took a while to convert everything over from working with Debian GNU/Linux to FreeBSD 12 (some script incompatibilities, different paths, some changes to web server configuration, networking IPv6 troubles). But in the end we ended up with a good, FreeBSD-based experience. Since the transition was successful, though certainly not seamless, I thought people might want to do a Q&amp;A on the migration process. Especially for those thinking of making the same switch.  News Roundup iked(8) automatic IPv6 blocking removed  iked(8) no longer automatically blocks unencrypted outbound IPv6 packets. This feature was intended to avoid accidental leakage, but in practice was found to mostly be a cause of misconfiguration. If you previously used iked(8)'s -6 flag to disable this feature, it is no longer needed and should be removed from /etc/rc.conf.local if used.  Linus says dont run ZFS  “Don’t use ZFS. It’s that simple. It was always more of a buzzword than anything else, I feel, and the licensing issues just make it a non-starter for me.” This is what Linus Torvalds said in a mailing list to once again express his disliking for ZFS filesystem specially over its licensing. To avoid unnecessary confusion, this is more intended for Linux distributions, kernel developers and maintainers rather than individual Linux users.  GSoC 2019 Final Report: Incorporating the memory-hard Argon2 hashing scheme into NetBSD  We successfully incorporated the Argon2 reference implementation into NetBSD/amd64 for our 2019 Google Summer of Coding project. We introduced our project here and provided some hints on how to select parameters here. For our final report, we will provide an overview of what changes were made to complete the project. The Argon2 reference implementation, available here, is available under both the Creative Commons CC0 1.0 and the Apache Public License 2.0. To import the reference implementation into src/external, we chose to use the Apache 2.0 license for this project.  Working towards LLDB on i386 NetBSD  Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages. In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support. Throughout December I've continued working on our build bot maintenance, in particular enabling compiler-rt tests. I've revived and finished my old patch for extended register state (XState) in core dumps. I've started working on bringing proper i386 support to LLDB.  Beastie Bits  An open source Civilization V BSD Groups in Italy Why is Wednesday, November 17, 1858 the base time for OpenVMS? Benchmarking shell pipelines and the Unix “tools” philosophy LPI and BSD working together  Feedback/Questions  Pat - March Meeting Madhukar - Overheating Laptop Warren - R vs S   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Upgrading FreeBSD from 11.3 to 12.1, Distrowatch switching to FreeBSD, Torvalds says don’t run ZFS, iked(8) removed automatic IPv6 blocking, working towards LLDB on i386, and memory-hard Argon2 hashing scheme in NetBSD.</p> <h2>Headlines</h2> <h3><a href="https://blog.bimajority.org/2020/01/13/upgrading-freebsd-from-11-3-to-12-1/" rel="nofollow" target="_blank">Upgrading FreeBSD from 11.3 to 12.1</a></h3> <blockquote> <p>Now here’s something more like what I was originally expecting the content on this blog to look like. I’m in the process of moving all of our FreeBSD servers (about 30 in total) from 11.3 to 12.1. We have our own local build of the OS, and until “packaged base” gets to a state where it’s reliably usable, we’re stuck doing upgrades the old-fashioned way. I created a set of notes for myself while cranking through these upgrades and I wanted to share them since they are not really work-specific and this process isn’t very well documented for people who haven’t been doing this sort of upgrade process for 25 years.</p> <p>Our source and object trees are read-only exported from the build server over NFS, which causes things to be slow. /etc/make.conf and /etc/src.conf are symbolic links on all of our servers to the master copies in /usr/src so that make installworld can find the configuration parameters the system was built with.</p> </blockquote> <h3><a href="https://www.reddit.com/r/freebsd/comments/eodhit/switching_distrowatch_over_to_freebsd_ama/" rel="nofollow" target="_blank">Switching Distrowatch over to BSD</a></h3> <blockquote> <p>This may be a little off-topic for this board (forgive me if it is, please). However, I wanted to say that I'm one of the people who works on DistroWatch (<a href="http://distrowatch.com" rel="nofollow" target="_blank">distrowatch.com</a>) and this past week we had to deal with a server facing hardware failure. We had a discussion about whether to continue running Debian or switch to something else.</p> <p>The primary "something else" option turned out to be FreeBSD and it is what we eventually went with. It took a while to convert everything over from working with Debian GNU/Linux to FreeBSD 12 (some script incompatibilities, different paths, some changes to web server configuration, networking IPv6 troubles). But in the end we ended up with a good, FreeBSD-based experience.</p> <p>Since the transition was successful, though certainly not seamless, I thought people might want to do a Q&amp;A on the migration process. Especially for those thinking of making the same switch.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://www.openbsd.org/faq/current.html#r20200114" rel="nofollow" target="_blank">iked(8) automatic IPv6 blocking removed</a></h3> <blockquote> <p>iked(8) no longer automatically blocks unencrypted outbound IPv6 packets. This feature was intended to avoid accidental leakage, but in practice was found to mostly be a cause of misconfiguration.</p> <p>If you previously used iked(8)'s -6 flag to disable this feature, it is no longer needed and should be removed from /etc/rc.conf.local if used.</p> </blockquote> <h3><a href="https://itsfoss.com/linus-torvalds-zfs/" rel="nofollow" target="_blank">Linus says dont run ZFS</a></h3> <blockquote> <p>“Don’t use ZFS. It’s that simple. It was always more of a buzzword than anything else, I feel, and the licensing issues just make it a non-starter for me.”</p> <p>This is what Linus Torvalds said in a mailing list to once again express his disliking for ZFS filesystem specially over its licensing.</p> <p>To avoid unnecessary confusion, this is more intended for Linux distributions, kernel developers and maintainers rather than individual Linux users.</p> </blockquote> <h3><a href="https://blog.netbsd.org/tnf/entry/gsoc_2019_final_report_incorporating" rel="nofollow" target="_blank">GSoC 2019 Final Report: Incorporating the memory-hard Argon2 hashing scheme into NetBSD</a></h3> <blockquote> <p>We successfully incorporated the Argon2 reference implementation into NetBSD/amd64 for our 2019 Google Summer of Coding project. We introduced our project here and provided some hints on how to select parameters here. For our final report, we will provide an overview of what changes were made to complete the project.</p> <p>The Argon2 reference implementation, available here, is available under both the Creative Commons CC0 1.0 and the Apache Public License 2.0. To import the reference implementation into src/external, we chose to use the Apache 2.0 license for this project.</p> </blockquote> <h3><a href="https://blog.netbsd.org/tnf/entry/working_towards_lldb_on_i386" rel="nofollow" target="_blank">Working towards LLDB on i386 NetBSD</a></h3> <blockquote> <p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p> <p>In February 2019, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues, fixing watchpoint and threading support.</p> <p>Throughout December I've continued working on our build bot maintenance, in particular enabling compiler-rt tests. I've revived and finished my old patch for extended register state (XState) in core dumps. I've started working on bringing proper i386 support to LLDB.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://github.com/yairm210/UnCiv" rel="nofollow" target="_blank">An open source Civilization V</a></li> <li><a href="https://bsdnotizie.blogspot.com/2020/01/gruppi-bsd-in-italia.html" rel="nofollow" target="_blank">BSD Groups in Italy</a></li> <li><a href="https://www.slac.stanford.edu/%7Erkj/crazytime.txt" rel="nofollow" target="_blank">Why is Wednesday, November 17, 1858 the base time for OpenVMS?</a></li> <li><a href="https://blog.plover.com/Unix/tools.html" rel="nofollow" target="_blank">Benchmarking shell pipelines and the Unix “tools” philosophy</a></li> <li><a href="https://youtu.be/QItb5aoj7Oc" rel="nofollow" target="_blank">LPI and BSD working together</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Pat - <a href="http://dpaste.com/2BMGZVV#wrap" rel="nofollow" target="_blank">March Meeting</a></li> <li>Madhukar - <a href="http://dpaste.com/17WNVM8#wrap" rel="nofollow" target="_blank">Overheating Laptop</a></li> <li>Warren - <a href="http://dpaste.com/3AZYFB1#wrap" rel="nofollow" target="_blank">R vs S</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

Distrowatch Running FreeBSD | BSD Now 334

Your Impact on FreeBSD in 2019, Wireguard on OpenBSD Router, Amazon now has FreeBSD/ARM 12, pkgsrc-2019Q4, The Joys of UNIX Keyboards, OpenBSD on Digital Ocean, and more. Headlines Your Impact on FreeBSD in 2019  It’s hard to believe that 2019 is nearly over. It has been an amazing year for supporting the FreeBSD Project and community! Why do I say that? Because as I reflect over the past 12 months, I realize how many events we’ve attended all over the world, and how many lives we’ve touched in so many ways. From advocating for FreeBSD to implementing FreeBSD features, my team has been there to help make FreeBSD the best open source project and operating system out there. In 2019, we focused on supporting a few key areas where the Project needed the most help. The first area was software development. Whether it was contracting FreeBSD developers to work on projects like wifi support, to providing internal staff to quickly implement hardware workarounds, we’ve stepped in to help keep FreeBSD innovative, secure, and reliable. Software development includes supporting the tools and infrastructure that make the development process go smoothly, and we’re on it with team members heading up the Continuous Integration efforts, and actively involved in the clusteradmin and security teams. Our advocacy efforts focused on recruiting new users and contributors to the Project. We attended and participated in 38 conferences and events in 21 countries. From giving FreeBSD presentations and workshops to staffing tables, we were able to have 1:1 conversations with thousands of attendees. Our travels also provided opportunities to talk directly with FreeBSD commercial and individual users, contributors, and future FreeBSD user/contributors. We’ve seen an increase in use and interest in FreeBSD from all of these organizations and individuals. These meetings give us a chance to learn more about what organizations need and what they and other individuals are working on. The information helps inform the work we should fund.  Wireguard on OpenBSD Router  wireguard (wg) is a modern vpn protocol, using the latest class of encryption algorithms while at the same time promising speed and a small code base. modern crypto and lean code are also tenants of openbsd, thus it was a no brainer to migrate my router from openvpn over to wireguard. my setup : a collection of devices, both wired and wireless, that are nat’d through my router (openbsd 6.6) out via my vpn provider azire* and out to the internet using wg-quick to start wg. running : doubtless this could be improved on, but currently i start wg manually when my router boots. this, and the nat'ing on the vpn interface mean its impossible for clients to connect to the internet without the vpn being up. as my router is on a ups and only reboots when a kernel patch requires it, it’s a compromise i can live with. run wg-quick (please replace vpn with whatever you named your wg .conf file.) and reload pf rules.  News Roundup Amazon now has FreeBSD/ARM 12  AWS, the cloud division of Amazon, announced in December the next generation of its ARM processors, the Graviton2. This is a custom chip design with a 7nm architecture. It is based on 64-bit ARM Neoverse cores. Compared to first-generation Graviton processors (A1), today’s new chips should deliver up to 7x the performance of A1 instances in some cases. Floating point performance is now twice as fast. There are additional memory channels and cache speed memory access should be much faster. The company is working on three types of Graviton2 EC2 instances that should be available soon. Instances with a “g” suffix are powered by Graviton2 chips. If they have a “d” suffix, it also means that they have NVMe local storage.  General-purpose instances (M6g and M6gd) Compute-optimized instances (C6g and C6gd) Memory-optimized instances (R6g and R6gd)  You can choose instances with up to 64 vCPUs, 512 GiB of memory and 25 Gbps networking. And you can see that ARM-powered servers are not just a fad. AWS already promises a 40% better price/performance ratio with ARM-based instances when you compare them with x86-based instances. AWS has been working with operating system vendors and independent software vendors to help them release software that runs on ARM. ARM-based EC2 instances support Amazon Linux 2, Ubuntu, Red Hat, SUSE, Fedora, Debian and FreeBSD. It also works with multiple container services (Docker, Amazon ECS, and Amazon Elastic Kubernetes Service).   Coverage of AWS Announcement   Announcing the pkgsrc-2019Q4 release  The pkgsrc developers are proud to announce the 65th quarterly release of pkgsrc, the cross-platform packaging system.  pkgsrc is available with more than 20,000 packages, running on 23 separate platforms; more information on pkgsrc itself is available at https://www.pkgsrc.org/ In total, 190 packages were added, 96 packages were removed, and 1,868 package updates (to 1388 unique packages) were processed since the pkgsrc-2019Q3 release.  As usual, a large number of updates and additions were processed for packages for go (14), guile (11), perl (170), php (10), python (426), and ruby (110).  This continues pkgsrc's tradition of adding useful packages, updating many packages to more current versions, and pruning unmaintained packages that are believed to have essentially no users.  The Joys of UNIX Keyboards  I fell in love with a dead keyboard layout. A decade or so ago while helping a friends father clean out an old building, we came across an ancient Sun Microsystems server. We found it curious. Everything about it was different from what we were used to. The command line was black on white, the connectors strange and foreign, and the keyboard layout was bizarre. We never did much with it; turning it on made all the lights in his home dim, and our joint knowledge of UNIX was nonexistent. It sat in his bedroom for years supporting his television at the foot of his bed. I never forgot that keyboard though. The thought that there was this alternative layout out there seemed intriguing to me.  OpenBSD on Digital Ocean  Last night I had a need to put together a new OpenBSD machine. Since I already use DigitalOcean for one of my public DNS servers I wanted to use them for this need but sadly like all too many of the cloud providers they don't support OpenBSD. Now they do support FreeBSD and I found a couple writeups that show how to use FreeBSD as a shim to install OpenBSD. They are both sort of old at this point and with OpenBSD 6.6 out I ran into a bit of a snag. The default these days is to use a GPT partition table to enable EFI booting. This is generally pretty sane but it looks to me like the FreeBSD droplet doesn't support this. After the installer rebooted the VM failed to boot, being unable to find the bootloader. Thankfully DigitalOcean has a recovery ISO that you can boot by simply switching to it and powering off and then on your Droplet.  Beastie Bits  FreeBSD defaults to LLVM on PPC Theo De Raadt Interview between Ottawa 2019 Hackathon and BSDCAN 2019 Bastille Poll about what people would like to see in 2020 Notes on the classic book : The Design of the UNIX Operating System Multics History First meeting of the Hamilton BSD user group, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St  Feedback/Questions  Bill - 1.1 CDROM Greg - More 50 Year anniversary information Dave - Question time for Allan   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Your Impact on FreeBSD in 2019, Wireguard on OpenBSD Router, Amazon now has FreeBSD/ARM 12, pkgsrc-2019Q4, The Joys of UNIX Keyboards, OpenBSD on Digital Ocean, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.freebsdfoundation.org/blog/your-impact-on-freebsd-in-2019/" rel="nofollow" target="_blank">Your Impact on FreeBSD in 2019</a></h3> <blockquote> <p>It’s hard to believe that 2019 is nearly over. It has been an amazing year for supporting the FreeBSD Project and community! Why do I say that? Because as I reflect over the past 12 months, I realize how many events we’ve attended all over the world, and how many lives we’ve touched in so many ways. From advocating for FreeBSD to implementing FreeBSD features, my team has been there to help make FreeBSD the best open source project and operating system out there.</p> <p>In 2019, we focused on supporting a few key areas where the Project needed the most help. The first area was software development. Whether it was contracting FreeBSD developers to work on projects like wifi support, to providing internal staff to quickly implement hardware workarounds, we’ve stepped in to help keep FreeBSD innovative, secure, and reliable. Software development includes supporting the tools and infrastructure that make the development process go smoothly, and we’re on it with team members heading up the Continuous Integration efforts, and actively involved in the clusteradmin and security teams.</p> <p>Our advocacy efforts focused on recruiting new users and contributors to the Project. We attended and participated in 38 conferences and events in 21 countries. From giving FreeBSD presentations and workshops to staffing tables, we were able to have 1:1 conversations with thousands of attendees.</p> <p>Our travels also provided opportunities to talk directly with FreeBSD commercial and individual users, contributors, and future FreeBSD user/contributors. We’ve seen an increase in use and interest in FreeBSD from all of these organizations and individuals. These meetings give us a chance to learn more about what organizations need and what they and other individuals are working on. The information helps inform the work we should fund.</p> </blockquote> <h3><a href="https://obscurity.xyz/bsd/open/wireguard.html" rel="nofollow" target="_blank">Wireguard on OpenBSD Router</a></h3> <blockquote> <p>wireguard (wg) is a modern vpn protocol, using the latest class of encryption algorithms while at the same time promising speed and a small code base.</p> <p>modern crypto and lean code are also tenants of openbsd, thus it was a no brainer to migrate my router from openvpn over to wireguard.</p> <p>my setup : a collection of devices, both wired and wireless, that are nat’d through my router (openbsd 6.6) out via my vpn provider azire* and out to the internet using wg-quick to start wg.</p> <p>running : doubtless this could be improved on, but currently i start wg manually when my router boots. this, and the nat'ing on the vpn interface mean its impossible for clients to connect to the internet without the vpn being up. as my router is on a ups and only reboots when a kernel patch requires it, it’s a compromise i can live with. run wg-quick (please replace vpn with whatever you named your wg .conf file.) and reload pf rules.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://aws.amazon.com/marketplace/pp/B081NF7BY7" rel="nofollow" target="_blank">Amazon now has FreeBSD/ARM 12</a></h3> <blockquote> <p>AWS, the cloud division of Amazon, announced in December the next generation of its ARM processors, the Graviton2. This is a custom chip design with a 7nm architecture. It is based on 64-bit ARM Neoverse cores.</p> <p>Compared to first-generation Graviton processors (A1), today’s new chips should deliver up to 7x the performance of A1 instances in some cases. Floating point performance is now twice as fast. There are additional memory channels and cache speed memory access should be much faster.</p> <p>The company is working on three types of Graviton2 EC2 instances that should be available soon. Instances with a “g” suffix are powered by Graviton2 chips. If they have a “d” suffix, it also means that they have NVMe local storage.</p> <ul> <li><p>General-purpose instances (M6g and M6gd)</p></li> <li><p>Compute-optimized instances (C6g and C6gd)</p></li> <li><p>Memory-optimized instances (R6g and R6gd)</p></li> </ul> <p>You can choose instances with up to 64 vCPUs, 512 GiB of memory and 25 Gbps networking.</p> <p>And you can see that ARM-powered servers are not just a fad. AWS already promises a 40% better price/performance ratio with ARM-based instances when you compare them with x86-based instances.</p> <p>AWS has been working with operating system vendors and independent software vendors to help them release software that runs on ARM. ARM-based EC2 instances support Amazon Linux 2, Ubuntu, Red Hat, SUSE, Fedora, Debian and FreeBSD. It also works with multiple container services (Docker, Amazon ECS, and Amazon Elastic Kubernetes Service).</p> </blockquote> <ul> <li><a href="https://techcrunch.com/2019/12/03/aws-announces-new-arm-based-instances-with-graviton2-processors/" rel="nofollow" target="_blank">Coverage of AWS Announcement </a></li> </ul> <h3><a href="https://mail-index.netbsd.org/pkgsrc-users/2020/01/06/msg030130.html" rel="nofollow" target="_blank">Announcing the pkgsrc-2019Q4 release</a></h3> <blockquote> <p>The pkgsrc developers are proud to announce the 65th quarterly release of pkgsrc, the cross-platform packaging system.  pkgsrc is available with more than 20,000 packages, running on 23 separate platforms; more information on pkgsrc itself is available at <a href="https://www.pkgsrc.org/" rel="nofollow" target="_blank">https://www.pkgsrc.org/</a></p> <p>In total, 190 packages were added, 96 packages were removed, and 1,868 package updates (to 1388 unique packages) were processed since the pkgsrc-2019Q3 release.  As usual, a large number of updates and additions were processed for packages for go (14), guile (11), perl (170), php (10), python (426), and ruby (110).  This continues pkgsrc's tradition of adding useful packages, updating many packages to more current versions, and pruning unmaintained packages that are believed to have essentially no users.</p> </blockquote> <h3><a href="https://donatstudios.com/UNIX-Keyboards" rel="nofollow" target="_blank">The Joys of UNIX Keyboards</a></h3> <blockquote> <p>I fell in love with a dead keyboard layout.</p> <p>A decade or so ago while helping a friends father clean out an old building, we came across an ancient Sun Microsystems server. We found it curious. Everything about it was different from what we were used to. The command line was black on white, the connectors strange and foreign, and the keyboard layout was bizarre.</p> <p>We never did much with it; turning it on made all the lights in his home dim, and our joint knowledge of UNIX was nonexistent. It sat in his bedroom for years supporting his television at the foot of his bed.</p> <p>I never forgot that keyboard though. The thought that there was this alternative layout out there seemed intriguing to me.</p> </blockquote> <h3><a href="https://www.going-flying.com/blog/openbsd-on-digitalocean.html" rel="nofollow" target="_blank">OpenBSD on Digital Ocean</a></h3> <blockquote> <p>Last night I had a need to put together a new OpenBSD machine. Since I already use DigitalOcean for one of my public DNS servers I wanted to use them for this need but sadly like all too many of the cloud providers they don't support OpenBSD. Now they do support FreeBSD and I found a couple writeups that show how to use FreeBSD as a shim to install OpenBSD.</p> <p>They are both sort of old at this point and with OpenBSD 6.6 out I ran into a bit of a snag. The default these days is to use a GPT partition table to enable EFI booting. This is generally pretty sane but it looks to me like the FreeBSD droplet doesn't support this. After the installer rebooted the VM failed to boot, being unable to find the bootloader.</p> <p>Thankfully DigitalOcean has a recovery ISO that you can boot by simply switching to it and powering off and then on your Droplet.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=356111" rel="nofollow" target="_blank">FreeBSD defaults to LLVM on PPC</a></li> <li><a href="https://undeadly.org/cgi?action=article;sid=20191231214356" rel="nofollow" target="_blank">Theo De Raadt Interview between Ottawa 2019 Hackathon and BSDCAN 2019</a></li> <li><a href="https://twitter.com/BastilleBSD/status/1211475103143251968" rel="nofollow" target="_blank">Bastille Poll about what people would like to see in 2020</a></li> <li><a href="https://github.com/suvratapte/Maurice-Bach-Notes" rel="nofollow" target="_blank">Notes on the classic book : The Design of the UNIX Operating System</a></li> <li><a href="https://www.multicians.org/" rel="nofollow" target="_blank">Multics History</a></li> <li><a href="http://studybsd.com/" rel="nofollow" target="_blank">First meeting of the Hamilton BSD user group, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Bill - <a href="http://dpaste.com/2H9CW6R" rel="nofollow" target="_blank">1.1 CDROM</a></li> <li>Greg - <a href="http://dpaste.com/2SGA3KY" rel="nofollow" target="_blank">More 50 Year anniversary information</a></li> <li>Dave - <a href="http://dpaste.com/3ZAEKHD#wrap" rel="nofollow" target="_blank">Question time for Allan</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

Unix Keyboard Joy | BSD Now 333

Announcing HyperbolaBSD, IPFW In-Kernel NAT setup on FreeBSD, Wayland and WebRTC enabled for NetBSD 9/Linux, LLDB Threading support ready for mainline, OpenSSH U2F/FIDO support in base, Dragonfly drm/i915: Update, and more. Headlines HyperbolaBSD Announcement  Due to the Linux kernel rapidly proceeding down an unstable path, we are planning on implementing a completely new OS derived from several BSD implementations. This was not an easy decision to make, but we wish to use our time and resources to create a viable alternative to the current operating system trends which are actively seeking to undermine user choice and freedom. This will not be a "distro", but a hard fork of the OpenBSD kernel and userspace including new code written under GPLv3 and LGPLv3 to replace GPL-incompatible parts and non-free ones.   Reasons for this include:   Linux kernel forcing adaption of DRM, including HDCP. Linux kernel proposed usage of Rust (which contains freedom flaws and a centralized code repository that is more prone to cyber attack and generally requires internet access to use.) Linux kernel being written without security and in mind. (KSPP is basically a dead project and Grsec is no longer free software) Many GNU userspace and core utils are all forcing adaption of features without build time options to disable them. E.g. (PulseAudio / SystemD / Rust / Java as forced dependencies) As such, we will continue to support the Milky Way branch until 2022 when our legacy Linux-libre kernel reaches End of Life.    Future versions of Hyperbola will be using HyperbolaBSD which will have the new kernel, userspace and not be ABI compatible with previous versions. HyperbolaBSD is intended to be modular and minimalist so other projects will be able to re-use the code under free license.   Forum Post   A simple IPFW In-Kernel NAT setup on FreeBSD  After graduating college, I am moving from Brooklyn, NY to Redmond, WA (guess where I got a job). I always wanted to re-do my OPNsense firewall (currently a HP T730) with stock FreeBSD and IPFW’s in-kernel NAT. Why IPFW? Benchmarks have shown IPFW to be faster which is especially good for my Tor relay, and because I can! However, one downside of IPFW is less documentation vs PF, even less without natd (which we’re not using), and this took me time to figure this out. But since my T730 is already packed, I am testing this on a old PC with two NICs, and my laptop [1] as a client with an USB-to-Ethernet adapter.  News Roundup HEADS UP: Wayland and WebRTC enabled for NetBSD 9/Linux  This is just a heads up that the Wayland option is now turned on by  default for NetBSD 9 and Linux in cases where it peacefully coexists with X11.   Right now, this effects the following packages:    graphics/MesaLib devel/SDL2 www/webkit-gtk x11/gtk3    The WebRTC option has also been enabled by default on NetBSD 9 for two Firefox versions: www/firefox, www/firefox68 Please keep me informed of any fallout. Hopefully, there will be none. If you want to try out Wayland-related things on NetBSD 9, wm/velox/MESSAGE may be interesting for you.  LLDB Threading support now ready for mainline  Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages. In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report. So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.  OpenSSH U2F/FIDO support in base  Hardware backed keys can be generated using "ssh-keygen -t ecdsa-sk" (or "ed25519-sk" if your token supports it). Many tokens require to be touched/tapped to confirm this step. You'll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a "key handle" that is used by the security key to derive the real private key at signing time. So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything.  drm/i915: Update to Linux 4.8.17   drm/i915: Update to Linux 4.8.17   Broxton, Valleyview and Cherryview support improvements Broadwell and Gen9/Skylake support improvements Broadwell brightness fixes from OpenBSD Atomic modesetting improvements Various bug fixes and performance enhancements   Beastie Bits  Visual Studio Code port for FreeBSD OpenBSD syscall call-from verification Peertube on OpenBSD Fuzzing Filesystems on NetBSD via AFL+KCOV by Maciej Grochowski Twitter Bot for Prop65 Interactive vim tutorial First BSD user group meeting in Hamilton, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St ***  Feedback/Questions  Samir - cgit Russell - R Wolfgang - Question   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv            Your browser does not support the HTML5 video tag. 

<p>Announcing HyperbolaBSD, IPFW In-Kernel NAT setup on FreeBSD, Wayland and WebRTC enabled for NetBSD 9/Linux, LLDB Threading support ready for mainline, OpenSSH U2F/FIDO support in base, Dragonfly drm/i915: Update, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.hyperbola.info/news/announcing-hyperbolabsd-roadmap/" rel="nofollow" target="_blank">HyperbolaBSD Announcement</a></h3> <blockquote> <p>Due to the Linux kernel rapidly proceeding down an unstable path, we are planning on implementing a completely new OS derived from several BSD implementations.</p> <p>This was not an easy decision to make, but we wish to use our time and resources to create a viable alternative to the current operating system trends which are actively seeking to undermine user choice and freedom.</p> <p>This will not be a "distro", but a hard fork of the OpenBSD kernel and userspace including new code written under GPLv3 and LGPLv3 to replace GPL-incompatible parts and non-free ones.</p> </blockquote> <ul> <li>Reasons for this include:  <ul> <li>Linux kernel forcing adaption of DRM, including HDCP.</li> <li>Linux kernel proposed usage of Rust (which contains freedom flaws and a centralized code repository that is more prone to cyber attack and generally requires internet access to use.)</li> <li>Linux kernel being written without security and in mind. (KSPP is basically a dead project and Grsec is no longer free software)</li> <li>Many GNU userspace and core utils are all forcing adaption of features without build time options to disable them. E.g. (PulseAudio / SystemD / Rust / Java as forced dependencies)</li> <li>As such, we will continue to support the Milky Way branch until 2022 when our legacy Linux-libre kernel reaches End of Life.</li> </ul></li> </ul> <blockquote> <p>Future versions of Hyperbola will be using HyperbolaBSD which will have the new kernel, userspace and not be ABI compatible with previous versions.</p> <p>HyperbolaBSD is intended to be modular and minimalist so other projects will be able to re-use the code under free license.</p> </blockquote> <ul> <li><a href="https://forums.hyperbola.info/viewtopic.php?id=315" rel="nofollow" target="_blank">Forum Post</a> </li> </ul> <h3><a href="https://www.neelc.org/posts/freebsd-ipfw-nat/" rel="nofollow" target="_blank">A simple IPFW In-Kernel NAT setup on FreeBSD</a></h3> <blockquote> <p>After graduating college, I am moving from Brooklyn, NY to Redmond, WA (guess where I got a job). I always wanted to re-do my OPNsense firewall (currently a HP T730) with stock FreeBSD and IPFW’s in-kernel NAT.</p> <p>Why IPFW? Benchmarks have shown IPFW to be faster which is especially good for my Tor relay, and because I can! However, one downside of IPFW is less documentation vs PF, even less without natd (which we’re not using), and this took me time to figure this out.</p> <p>But since my T730 is already packed, I am testing this on a old PC with two NICs, and my laptop [1] as a client with an USB-to-Ethernet adapter.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://mail-index.netbsd.org/pkgsrc-users/2020/01/05/msg030124.html" rel="nofollow" target="_blank">HEADS UP: Wayland and WebRTC enabled for NetBSD 9/Linux</a></h3> <blockquote> <p>This is just a heads up that the Wayland option is now turned on by</p> </blockquote> <p>default for NetBSD 9 and Linux in cases where it peacefully coexists<br/> with X11. </p> <ul> <li>Right now, this effects the following packages:   <ul> <li>graphics/MesaLib</li> <li>devel/SDL2</li> <li>www/webkit-gtk</li> <li>x11/gtk3</li> </ul></li> </ul> <blockquote> <p>The WebRTC option has also been enabled by default on NetBSD 9 for two Firefox versions: www/firefox, www/firefox68</p> <p>Please keep me informed of any fallout. Hopefully, there will be none.</p> <p>If you want to try out Wayland-related things on NetBSD 9, wm/velox/MESSAGE may be interesting for you.</p> </blockquote> <h3><a href="https://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready" rel="nofollow" target="_blank">LLDB Threading support now ready for mainline</a></h3> <blockquote> <p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p> <p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p> <p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p> </blockquote> <h3><a href="https://www.undeadly.org/cgi?action=article;sid=20191115064850" rel="nofollow" target="_blank">OpenSSH U2F/FIDO support in base</a></h3> <blockquote> <p>Hardware backed keys can be generated using "ssh-keygen -t ecdsa-sk" (or "ed25519-sk" if your token supports it). Many tokens require to be touched/tapped to confirm this step.</p> <p>You'll get a public/private keypair back as usual, except in this case, the private key file does not contain a highly-sensitive private key but instead holds a "key handle" that is used by the security key to derive the real private key at signing time.</p> <p>So, stealing a copy of the private key file without also stealing your security key (or access to it) should not give the attacker anything.</p> </blockquote> <h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-December/720257.html" rel="nofollow" target="_blank">drm/i915: Update to Linux 4.8.17</a></h3> <ul> <li> drm/i915: Update to Linux 4.8.17  <ul> <li>Broxton, Valleyview and Cherryview support improvements</li> <li>Broadwell and Gen9/Skylake support improvements</li> <li>Broadwell brightness fixes from OpenBSD</li> <li>Atomic modesetting improvements</li> <li>Various bug fixes and performance enhancements</li> </ul></li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://github.com/tagattie/FreeBSD-VSCode" rel="nofollow" target="_blank">Visual Studio Code port for FreeBSD</a></li> <li><a href="https://marc.info/?l=openbsd-tech&amp;m=157488907117170&amp;w=2" rel="nofollow" target="_blank">OpenBSD syscall call-from verification</a></li> <li><a href="https://www.22decembre.eu/en/2019/12/09/peertube-14-openbsd/" rel="nofollow" target="_blank">Peertube on OpenBSD</a></li> <li><a href="https://www.youtube.com/watch?v=bbNCqFdQEyk&amp;feature=youtu.be" rel="nofollow" target="_blank">Fuzzing Filesystems on NetBSD via AFL+KCOV by Maciej Grochowski</a></li> <li><a href="https://twitter.com/prop65bot/status/1199003319307558912" rel="nofollow" target="_blank">Twitter Bot for Prop65</a></li> <li><a href="https://www.openvim.com/" rel="nofollow" target="_blank">Interactive vim tutorial</a></li> <li><a href="http://studybsd.com/" rel="nofollow" target="_blank">First BSD user group meeting in Hamilton, February 11, 2020 18:30 - 21:00, Boston Pizza on Upper James St</a> ***</li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Samir - <a href="http://dpaste.com/2B22M24#wrap" rel="nofollow" target="_blank">cgit</a></li> <li>Russell - <a href="http://dpaste.com/0J5TYY0#wrap" rel="nofollow" target="_blank">R</a></li> <li>Wolfgang - <a href="http://dpaste.com/3MQAH27#wrap" rel="nofollow" target="_blank">Question</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p>          Your browser does not support the HTML5 video tag. </p>

The BSD Hyperbole | BSD Now 332

How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more. Headlines Why computers suck and how learning from OpenBSD can make them marginally less horrible  How much better could things actually be if we abandoned the enterprise development model?  Next I will compare this enterprise development approach with non-enterprise development - projects such as OpenBSD, which do not hesitate to introduce ABI breaking changes to improve the codebase. One of the most commonly referred to pillars of the project's philosophy has long been its emphasis on clean functional code. Any code which makes it into OpenBSD is subject to ongoing aggressive audits for deprecated, or otherwise unmaintained code in order to reduce cruft and attack surface. Additionally the project creator, Theo de Raadt, and his team of core developers engage in ongoing development for proactive mitigations for various attack classes many of which are directly adopted by various multi-platform userland applications as well as the operating systems themselves (Windows, Linux, and the other BSDs). Frequently it is the case that introducing new features (not just deprecating old ones) introduces new incompatibilities against previously functional binaries compiled for OpenBSD.  To prevent the sort of kernel memory bloat that has plagued so many other operating systems for years, the project enforces a hard ceiling on the number of lines of code that can ever be in ring 0 at a given time. Current estimates guess the number of bugs per line of code in the Linux kernel are around 1 bug per every 10,000 lines of code. Think of this in the context of the scope creep seen in the Linux kernel (which if I recall correctly is currently at around 100,000,000 lines of code), as well as the Windows NT kernel (500,000,000 lines of code) and you quickly begin to understand how adding more and more functionality into the most privileged components of the operating system without first removing old components begins to add up in terms of the drastic difference seen between these systems in the number of zero day exploits caught in the wild respectively.  How Unix Works: Become a Better Software Engineer  Unix is beautiful. Allow me to paint some happy little trees for you. I’m not going to explain a bunch of commands – that’s boring, and there’s a million tutorials on the web doing that already. I’m going to leave you with the ability to reason about the system. Every fancy thing you want done is one google search away. But understanding why the solution does what you want is not the same. That’s what gives you real power, the power to not be afraid. And since it rhymes, it must be true.  News Roundup FreeBSD 12.1 Runs Refreshingly Well With AMD Ryzen Threadripper 3970X  For those of you interested in AMD's new Ryzen Threadripper 3960X/3970X processors with TRX40 motherboards for running FreeBSD, the experience in our initial testing has been surprisingly pleasant. In fact, it works out-of-the-box which one could argue is better than the current Linux support that needs the MCE workaround for booting. Here are some benchmarks of FreeBSD 12.1 on the Threadripper 3970X compared to Linux and Windows for this new HEDT platform. It was refreshing to see FreeBSD 12.1 booting and running just fine with the Ryzen Threadripper 3970X 32-core/64-thread processor from the ASUS ROG ZENITH II EXTREME motherboard and all core functionality working including the PCIe 4.0 NVMe SSD storage, onboard networking, etc. The system was running with 4 x 16GB DDR4-3600 memory, 1TB Corsair Force MP600 NVMe SSD, and Radeon RX 580 graphics. It was refreshing to see FreeBSD 12.1 running well with this high-end AMD Threadripper system considering Linux even needed a boot workaround. While the FreeBSD 12.1 experience was trouble-free with the ASUS TRX40 motherboard (ROG Zenith II Extreme) and AMD Ryzen Threadripper 3970X, DragonFlyBSD unfortunately was not. Both DragonFlyBSD 5.6.2 stable and the DragonFlyBSD daily development snapshot from last week were yielding a panic on boot. So with that, DragonFlyBSD wasn't tested for this Threadripper 3970X comparison but just FreeBSD 12.1. FreeBSD 12.1 on the Threadripper 3970X was benchmarked both with its default LLVM Clang 8.0.1 compiler and again with GCC 9.2 from ports for ruling out compiler differences. The FreeBSD 12.1 performance was compared to last week's Windows 10 vs. Linux benchmarks with the same system.  BSDCan 2020 CFP  BSDCan 2020 will be held 5-6 (Fri-Sat) June, 2020 in Ottawa, at the University of Ottawa. It will be preceded by two days of tutorials on 3-4 June (Wed-Thu). NOTE the change of month in 2020 back to June Also: do not miss out on the Goat BOF on Tuesday 2 June. We are now accepting proposals for talks.  The talks should be designed with a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.   See http://www.bsdcan.org/2020/   If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal. Possible topics include:   How we manage a giant installation with respect to handling spam. and/or sysadmin. and/or networking. Cool new stuff in BSD Tell us about your project which runs on BSD other topics (see next paragraph)   From the BSDCan website, the Archives section will allow you to review the wide variety of past BSDCan presentations as further examples. Both users and developers are encouraged to share their experiences.  HardenedBSD Infrastructure Goals  2019 has been an extremely productive year with regards to HardenedBSD's infrastructure. Several opportunities aligned themselves in such a way as to open a door for a near-complete rebuild with a vast expansion. The last few months especially have seen a major expansion of our infrastructure. We obtained a number of to-be-retired Dell R410 servers. The crash of our nightly build server provided the opportunity to deploy these R410 servers, doubling our build capacity. My available time to spend on HardenedBSD has decreased compared to this time last year. As part of rebuilding our infrastructure, I wanted to enable the community to be able to contribute. I'm structuring the work such that help is just a pull request away. Those in the HardenedBSD community who want to contribute to the infrastructure work can simply open a pull request. I'll review the code, and deploy it after a successful review. Users/contributors don't need access to our servers in order to improve them. My primary goal for the rest of 2019 and into 2020 is to become fully self-hosted, with the sole exception of email. I want to transition the source-of-truth git repos to our own infrastructure. We will still provide a read-only mirror on GitHub. As I develop this infrastructure, I'm doing so with human rights in mind. HardenedBSD is in a very unique position. In 2020, I plan to provide production Tor Onion Services for the various bits of our infrastructure. HardenedBSD will provide access to its various internal services to its developers and contributors. The entire development lifecycle, going from dev to prod, will be able to happen over Tor. Transparency will be key moving forward. Logs for the auto-sync script are now published directly to GitHub. Build logs will be, soon, too. Logs of all automated processes, and the code for those processes, will be tracked publicly via git. This will be especially crucial for development over Tor. Integrating Tor into our infrastructure so deeply increases risk and maintenance burden. However, I believe that through added transparency, we will be able to mitigate risk. Periodic audits will need to be performed and published. I hope to migrate HardenedBSD's site away from Drupal to a static site generator. We don't really need the dynamic capabilities Drupal gives us. The many security issues Drupal and PHP both bring also leave much to be desired. So, that's about it. I spent the last few months of 2019 laying the foundation for a successful 2020. I'm excited to see how the project grows.  Beastie Bits  FuryBSD - KDE plasma flavor now available DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud LPI is looking for BSD Specialist learning material writers ZFS sync/async + ZIL/SLOG, explained BSD-Licensed Combinatorics library/utility SSL client vs server certificates and bacula-fd MaxxDesktop planning to come to FreeBSD Project Page  Feedback/Questions  Tom - ZFS Mirror with different speeds Jeff - Knowledge is power Johnny - Episode 324 response to Jacob Pat - NYC*BUG meeting Jan Meeting Location   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more.</p> <h2>Headlines</h2> <h3><a href="https://telegra.ph/Why-OpenBSD-is-marginally-less-horrible-12-05" rel="nofollow" target="_blank">Why computers suck and how learning from OpenBSD can make them marginally less horrible</a></h3> <blockquote> <p>How much better could things actually be if we abandoned the enterprise development model? </p> <p>Next I will compare this enterprise development approach with non-enterprise development - projects such as OpenBSD, which do not hesitate to introduce ABI breaking changes to improve the codebase.</p> <p>One of the most commonly referred to pillars of the project's philosophy has long been its emphasis on clean functional code. Any code which makes it into OpenBSD is subject to ongoing aggressive audits for deprecated, or otherwise unmaintained code in order to reduce cruft and attack surface. Additionally the project creator, Theo de Raadt, and his team of core developers engage in ongoing development for proactive mitigations for various attack classes many of which are directly adopted by various multi-platform userland applications as well as the operating systems themselves (Windows, Linux, and the other BSDs). Frequently it is the case that introducing new features (not just deprecating old ones) introduces new incompatibilities against previously functional binaries compiled for OpenBSD. </p> <p>To prevent the sort of kernel memory bloat that has plagued so many other operating systems for years, the project enforces a hard ceiling on the number of lines of code that can ever be in ring 0 at a given time. Current estimates guess the number of bugs per line of code in the Linux kernel are around 1 bug per every 10,000 lines of code. Think of this in the context of the scope creep seen in the Linux kernel (which if I recall correctly is currently at around 100,000,000 lines of code), as well as the Windows NT kernel (500,000,000 lines of code) and you quickly begin to understand how adding more and more functionality into the most privileged components of the operating system without first removing old components begins to add up in terms of the drastic difference seen between these systems in the number of zero day exploits caught in the wild respectively.</p> </blockquote> <h3><a href="https://neilkakkar.com/unix.html" rel="nofollow" target="_blank">How Unix Works: Become a Better Software Engineer</a></h3> <blockquote> <p>Unix is beautiful. Allow me to paint some happy little trees for you. I’m not going to explain a bunch of commands – that’s boring, and there’s a million tutorials on the web doing that already. I’m going to leave you with the ability to reason about the system.</p> <p>Every fancy thing you want done is one google search away.</p> <p>But understanding why the solution does what you want is not the same.</p> <p>That’s what gives you real power, the power to not be afraid.</p> <p>And since it rhymes, it must be true.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://www.phoronix.com/scan.php?page=article&amp;item=freebsd-amd-3970x&amp;num=1" rel="nofollow" target="_blank">FreeBSD 12.1 Runs Refreshingly Well With AMD Ryzen Threadripper 3970X</a></h3> <blockquote> <p>For those of you interested in AMD's new Ryzen Threadripper 3960X/3970X processors with TRX40 motherboards for running FreeBSD, the experience in our initial testing has been surprisingly pleasant. In fact, it works out-of-the-box which one could argue is better than the current Linux support that needs the MCE workaround for booting. Here are some benchmarks of FreeBSD 12.1 on the Threadripper 3970X compared to Linux and Windows for this new HEDT platform.</p> <p>It was refreshing to see FreeBSD 12.1 booting and running just fine with the Ryzen Threadripper 3970X 32-core/64-thread processor from the ASUS ROG ZENITH II EXTREME motherboard and all core functionality working including the PCIe 4.0 NVMe SSD storage, onboard networking, etc. The system was running with 4 x 16GB DDR4-3600 memory, 1TB Corsair Force MP600 NVMe SSD, and Radeon RX 580 graphics. It was refreshing to see FreeBSD 12.1 running well with this high-end AMD Threadripper system considering Linux even needed a boot workaround.</p> <p>While the FreeBSD 12.1 experience was trouble-free with the ASUS TRX40 motherboard (ROG Zenith II Extreme) and AMD Ryzen Threadripper 3970X, DragonFlyBSD unfortunately was not. Both DragonFlyBSD 5.6.2 stable and the DragonFlyBSD daily development snapshot from last week were yielding a panic on boot. So with that, DragonFlyBSD wasn't tested for this Threadripper 3970X comparison but just FreeBSD 12.1.</p> <p>FreeBSD 12.1 on the Threadripper 3970X was benchmarked both with its default LLVM Clang 8.0.1 compiler and again with GCC 9.2 from ports for ruling out compiler differences. The FreeBSD 12.1 performance was compared to last week's Windows 10 vs. Linux benchmarks with the same system.</p> </blockquote> <h3><a href="https://lists.bsdcan.org/pipermail/bsdcan-announce/2019-December/000180.html" rel="nofollow" target="_blank">BSDCan 2020 CFP</a></h3> <blockquote> <p>BSDCan 2020 will be held 5-6 (Fri-Sat) June, 2020 in Ottawa, at the University of Ottawa. It will be preceded by two days of tutorials on 3-4 June (Wed-Thu).</p> <p>NOTE the change of month in 2020 back to June Also: do not miss out on the Goat BOF on Tuesday 2 June.</p> <p>We are now accepting proposals for talks.  The talks should be designed with a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.</p> </blockquote> <ul> <li>See <a href="http://www.bsdcan.org/2020/" rel="nofollow" target="_blank">http://www.bsdcan.org/2020/</a></li> </ul> <blockquote> <p>If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal. Possible topics include:</p> </blockquote> <ul> <li>How we manage a giant installation with respect to handling spam.</li> <li>and/or sysadmin.</li> <li>and/or networking.</li> <li>Cool new stuff in BSD</li> <li>Tell us about your project which runs on BSD</li> <li>other topics (see next paragraph)</li> </ul> <blockquote> <p>From the BSDCan website, the Archives section will allow you to review the wide variety of past BSDCan presentations as further examples.</p> <p>Both users and developers are encouraged to share their experiences.</p> </blockquote> <h3><a href="https://github.com/lattera/articles/blob/master/hardenedbsd/2019-12-01_infrastructure/article.md" rel="nofollow" target="_blank">HardenedBSD Infrastructure Goals</a></h3> <blockquote> <p>2019 has been an extremely productive year with regards to HardenedBSD's infrastructure. Several opportunities aligned themselves in such a way as to open a door for a near-complete rebuild with a vast expansion.</p> <p>The last few months especially have seen a major expansion of our infrastructure. We obtained a number of to-be-retired Dell R410 servers. The crash of our nightly build server provided the opportunity to deploy these R410 servers, doubling our build capacity.</p> <p>My available time to spend on HardenedBSD has decreased compared to this time last year. As part of rebuilding our infrastructure, I wanted to enable the community to be able to contribute. I'm structuring the work such that help is just a pull request away. Those in the HardenedBSD community who want to contribute to the infrastructure work can simply open a pull request. I'll review the code, and deploy it after a successful review. Users/contributors don't need access to our servers in order to improve them.</p> <p>My primary goal for the rest of 2019 and into 2020 is to become fully self-hosted, with the sole exception of email. I want to transition the source-of-truth git repos to our own infrastructure. We will still provide a read-only mirror on GitHub.</p> <p>As I develop this infrastructure, I'm doing so with human rights in mind. HardenedBSD is in a very unique position. In 2020, I plan to provide production Tor Onion Services for the various bits of our infrastructure. HardenedBSD will provide access to its various internal services to its developers and contributors. The entire development lifecycle, going from dev to prod, will be able to happen over Tor.</p> <p>Transparency will be key moving forward. Logs for the auto-sync script are now published directly to GitHub. Build logs will be, soon, too. Logs of all automated processes, and the code for those processes, will be tracked publicly via git. This will be especially crucial for development over Tor.</p> <p>Integrating Tor into our infrastructure so deeply increases risk and maintenance burden. However, I believe that through added transparency, we will be able to mitigate risk. Periodic audits will need to be performed and published.</p> <p>I hope to migrate HardenedBSD's site away from Drupal to a static site generator. We don't really need the dynamic capabilities Drupal gives us. The many security issues Drupal and PHP both bring also leave much to be desired.</p> <p>So, that's about it. I spent the last few months of 2019 laying the foundation for a successful 2020. I'm excited to see how the project grows.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.furybsd.org/kde-plasma-flavor-now-available/" rel="nofollow" target="_blank">FuryBSD - KDE plasma flavor now available</a></li> <li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html" rel="nofollow" target="_blank">DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud</a></li> <li><a href="https://wiki.lpi.org/wiki/BSD_Specialist_Objectives_V1.0" rel="nofollow" target="_blank">LPI is looking for BSD Specialist learning material writers</a></li> <li><a href="https://jrs-s.net/2019/05/02/zfs-sync-async-zil-slog/" rel="nofollow" target="_blank">ZFS sync/async + ZIL/SLOG, explained</a></li> <li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-December/001921.html" rel="nofollow" target="_blank">BSD-Licensed Combinatorics library/utility</a></li> <li><a href="https://dan.langille.org/2019/11/29/ssl-client-vs-server-certificates-and-bacula-fd/" rel="nofollow" target="_blank">SSL client vs server certificates and bacula-fd</a></li> <li><a href="https://www.facebook.com/maxxdesktop/posts/2761326693888282" rel="nofollow" target="_blank">MaxxDesktop planning to come to FreeBSD</a> <a href="https://www.facebook.com/maxxdesktop/" rel="nofollow" target="_blank">Project Page</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Tom - <a href="http://dpaste.com/3ZGYNS3#wrap" rel="nofollow" target="_blank">ZFS Mirror with different speeds</a></li> <li>Jeff - <a href="http://dpaste.com/1H9QDCR#wrap" rel="nofollow" target="_blank">Knowledge is power</a></li> <li>Johnny - <a href="http://dpaste.com/1A7Q9EV" rel="nofollow" target="_blank">Episode 324 response to Jacob</a></li> <li>Pat - <a href="http://dpaste.com/0QPZ2GC" rel="nofollow" target="_blank">NYC*BUG meeting Jan Meeting Location</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p><br>    <br>    Your browser does not support the HTML5 video tag.<br></p>

Why Computers Suck | BSD Now 331

Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more. Headlines Authentication vulnerabilities in OpenBSD  We discovered an authentication-bypass vulnerability in OpenBSD's authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms. From the manual page of login.conf:  OpenBSD uses BSD Authentication, which is made up of a variety of authentication styles.  The authentication styles currently provided are:     &gt; passwd     Request a password and check it against the password in the master.passwd file.  See login_passwd(8).     &gt; skey       Send a challenge and request a response, checking it with S/Key (tm) authentication.  See login_skey(8).     &gt; yubikey    Authenticate using a Yubico YubiKey token.  See login_yubikey(8).     &gt; For any given style, the program /usr/libexec/auth/login_style is used to     &gt; perform the authentication.  The synopsis of this program is:  &gt; /usr/libexec/auth/login_style [-v name=value] [-s service] username class  This is the first piece of the puzzle: if an attacker specifies a username of the form "-option", they can influence the behavior of the authentication program in unexpected ways.   login_passwd [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class] The service argument specifies which protocol to use with the invoking program.  The allowed protocols are login, challenge, and response.  (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based).   This is the second piece of the puzzle: if an attacker specifies the username "-schallenge" (or "-schallenge:passwd" to force a passwd-style authentication), then the authentication is automatically successful and therefore bypassed. Case study: smtpd Case study: ldapd Case study: radiusd Case study: sshd Acknowledgments: We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. We also thank MITRE's CVE Assignment Team.  First release candidate for NetBSD 9.0 available!  Since the start of the release process four months ago a lot of improvements went into the branch - more than 500 pullups were processed! This includes usbnet (a common framework for usb ethernet drivers), aarch64 stability enhancements and lots of new hardware support, installer/sysinst fixes and changes to the NVMM (hardware virtualization) interface. We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year). Here are a few highlights of the new release: &gt; Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady" compliant machines (SBBR+SBSA) &gt; Enhanced hardware support for Armv7-A &gt; Updated GPU drivers (e.g. support for Intel Kabylake) &gt; Enhanced virtualization support &gt; Support for hardware-accelerated virtualization (NVMM) &gt; Support for Performance Monitoring Counters &gt; Support for Kernel ASLR &gt; Support several kernel sanitizers (KLEAK, KASAN, KUBSAN) &gt; Support for userland sanitizers &gt; Audit of the network stack &gt; Many improvements in NPF &gt; Updated ZFS &gt; Reworked error handling and NCQ support in the SATA subsystem &gt; Support a common framework for USB Ethernet drivers (usbnet) More information on the RC can be found on the NetBSD 9 release page  News Roundup Running FreeNAS on a Digitalocean droplet  ZFS is awesome. FreeBSD even more so. FreeNAS is the battle-tested, enterprise-ready-yet-home-user-friendly software defined storage solution which is cooler then deep space, based on FreeBSD and makes heavy use of ZFS. This is what I (and soooooo many others) use for just about any storage-related task. I can go on and on and on about what makes it great, but if you're here, reading this, you probably know all that already and we can skip ahead. I've needed an offsite FreeNAS setup to replicate things to, to run some things, to do some stuff, basically, my privately-owned, tightly-controlled NAS appliance in the cloud, one I control from top to bottom and with support for whatever crazy thing I'm trying to do. Since I'm using DigitalOcean as my main VPS provider, it seemed logical to run FreeNAS there, however, you can't. While DO supports many many distos and pre-setup applications (e.g OpenVPN), FreeNAS isn't a supported feature, at least not in the traditional way :) Before we begin, here's the gist of what we're going to do: &gt; Base of a FreeBSD droplet, we'll re-image our boot block device with FreeNAS iso. We'll then install FreeNAS on the second block device. Once done we're going to do the ol' switcheroo: we're going to re-image our original boot block device using the now FreeNAS-installed second block device.  Part 1: re-image our boot block device to boot FreeNAS install media. Part 2: Install FreeNAS on the second block-device Part 3: Re-image the boot block device using the FreeNAS-installed block device  NomadBSD 1.3 is now available  From the release notes:  &gt; The base system has been changed to FreeBSD 12.1-RELEASE-p1 Due to a deadlock problem, FreeBSD's unionfs has been replaced by unionfs-fuse The GPT layout has been changed to MBR. This prevents problems with Lenovo systems that refuse to boot from GPT if "lenovofix" is not set, and systems that hang on boot if "lenovofix" is set. Support for ZFS installations has been added to the NomadBSD installer. The rc-script for setting up the network interfaces has been fixed and improved. Support for setting the country code for the wlan device has been added. Auto configuration for running in VirtualBox has been added. A check for the default display has been added to the graphics configuration scripts. This fixes problems where users with Optimus have their NVIDIA card disabled, and use the integrated graphics chip instead. NVIDIA driver version 440 has been added. nomadbsd-dmconfig, a Qt tool for selecting the display manager theme, setting the default user and autologin has been added. nomadbsd-adduser, a Qt tool for added preconfigured user accounts to the system has been added. Martin Orszulik added Czech translations to the setup and installation wizard. The NomadBSD logo, designed by Ian Grindley, has been changed. Support for localized error messages has been added. Support for localizing the password prompts has been added. Some templates for starting other DEs have been added to ~/.xinitrc. The interfaces of nomadbsd-setup-gui and nomadbsd-install-gui have been improved. A script that helps users to configure a multihead systems has been added. The Xorg driver for newer Intel GPUs has been changed from "intel" to "modesetting". /proc has been added to /etc/fstab A D-Bus session issue has been fixed which prevented thunar from accessing  samba shares. DSBBg which allows users to change and manage wallpapers has been added. The latest version of update_obmenu now supports auto-updating the Openbox menu. Manually updating the Openbox menu after packet (de)installation is therefore no longer needed.   Support for multiple keyboard layouts has been added.  www/palemoon has been removed.  mail/thunderbird has been removed.  audio/audacity has been added.  deskutils/orage has been added.  the password manager fpm2 has been replaced by KeePassXC  mail/sylpheed has been replaced by mail/claws-mail  multimedia/simplescreenrecorder has been added.  DSBMC has been changed to DSBMC-Qt  Many small improvements and bug fixes.  At e2k19 nobody can hear you scream  After 2 years it was once again time to pack skis and snowshoes, put a satellite dish onto a sledge and hike through the snowy rockies to the Elk Lakes hut. I did not really have much of a plan what I wanted to work on but there were a few things I wanted to look into. One of them was rpki-client and the fact that it was so incredibly slow. Since Bob beck@ was around I started to ask him innocent X509 questions ... as if there are innocent X509 questions! Mainly about the abuse of the X509_STORE in rpki-client. Pretty soon it was clear that rpki-client did it all wrong and most of the X509 verification had to be rewritten. Instead of only storing the root certificates in the store and passing the intermediate certs as a chain to the verification function rpki-client threw everything into it. The X509_STORE is just not built for such an abuse and so it was no wonder that this was slow. Lucky me I pulled benno@ with me into this dark hole of libcrypto code. He managed to build up an initial diff to pass the chains as a STACK_OF(X509) and together we managed to get it working. A big thanks goes to ingo@ who documented most of the functions we had to use. Have a look at STACK_OF(3) and sk_pop_free(3) to understand why benno@ and I slowly turned crazy. Our next challenge was to only load the necessary certificate revocation list into the X509_STORE_CTX. While doing those changes it became obvious that some of the data structures needed better lookup functions. Looking up certificates was done using a linear lookup and so we replaced the internal certificate and CRL tables with RB trees for fast lookups. deraadt@ also joined the rpki-client commit fest and changed the output code to use rename(2) so that files are replaced in an atomic operation. Thanks to this rpki-client can now be safely run from cron (there is an example in the default crontab). I did not plan to spend most of my week hacking on rpki-client but in the end I'm happy that I did and the result is fairly impressive. Working with libcrypto code and especially X509 was less than pleasant. Our screams of agony died away in the snowy rocky mountains and made Bob deep dive into UVM with a smile since he knew that benno@ and I had it worse. In case you wonder thanks to all changes at e2k19 rpki-client improved from over 20min run time to validate all VRPS to roughly 1min to do the same job. A factor 20 improvement! Thanks to Theo, Bob and Howie to make this possible. To all the cooks for the great food and to Xplornet for providing us with Internet at the hut.  Beastie Bits  FOSDEM 2020 BSD Devroom schedule Easy Minecraft Server on FreeBSD Howto stats(3) framework in the TCP stack 4017 days of uptime sysget - A front-end for every package manager PlayOnBSD’s Cross-BSD Shopping Guide  Feedback/Questions  Pat asks about the proper disk drive type for ZFS Brad asks about a ZFS rosetta stone   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv            Your browser does not support the HTML5 video tag. Special Guest: Mariusz Zaborski.

<p>Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.openwall.com/lists/oss-security/2019/12/04/5" rel="nofollow" target="_blank">Authentication vulnerabilities in OpenBSD</a></h3> <ul> <li>We discovered an authentication-bypass vulnerability in OpenBSD's authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms.</li> <li><p>From the manual page of login.conf:</p> <blockquote> <p>OpenBSD uses BSD Authentication, which is made up of a variety of authentication styles.  The authentication styles currently provided are:<br/>     &gt; passwd     Request a password and check it against the password in the master.passwd file.  See login_passwd(8).<br/>     &gt; skey       Send a challenge and request a response, checking it with S/Key (tm) authentication.  See login_skey(8).<br/>     &gt; yubikey    Authenticate using a Yubico YubiKey token.  See login_yubikey(8).<br/>     &gt; For any given style, the program /usr/libexec/auth/login_style is used to<br/>     &gt; perform the authentication.  The synopsis of this program is:</p> </blockquote> <code>&gt; /usr/libexec/auth/login_style [-v name=value] [-s service] username class </code></li> <li><p>This is the first piece of the puzzle: if an attacker specifies a username of the form "-option", they can influence the behavior of the authentication program in unexpected ways.</p> <blockquote> <code> login_passwd [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class] The service argument specifies which protocol to use with the invoking program.  The allowed protocols are login, challenge, and response.  (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based). </code> </blockquote></li> <li><p>This is the second piece of the puzzle: if an attacker specifies the username "-schallenge" (or "-schallenge:passwd" to force a passwd-style authentication), then the authentication is automatically successful and therefore bypassed.</p></li> <li><p>Case study: smtpd</p></li> <li><p>Case study: ldapd</p></li> <li><p>Case study: radiusd</p></li> <li><p>Case study: sshd</p></li> <li><p>Acknowledgments: We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. We also thank MITRE's CVE Assignment Team.</p></li> </ul> <h3><a href="https://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd" rel="nofollow" target="_blank">First release candidate for NetBSD 9.0 available!</a></h3> <ul> <li>Since the start of the release process four months ago a lot of improvements went into the branch - more than 500 pullups were processed!</li> <li>This includes usbnet (a common framework for usb ethernet drivers), aarch64 stability enhancements and lots of new hardware support, installer/sysinst fixes and changes to the NVMM (hardware virtualization) interface.</li> <li>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</li> <li>Here are a few highlights of the new release: &gt; Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady" compliant machines (SBBR+SBSA) &gt; Enhanced hardware support for Armv7-A &gt; Updated GPU drivers (e.g. support for Intel Kabylake) &gt; Enhanced virtualization support &gt; Support for hardware-accelerated virtualization (NVMM) &gt; Support for Performance Monitoring Counters &gt; Support for Kernel ASLR &gt; Support several kernel sanitizers (KLEAK, KASAN, KUBSAN) &gt; Support for userland sanitizers &gt; Audit of the network stack &gt; Many improvements in NPF &gt; Updated ZFS &gt; Reworked error handling and NCQ support in the SATA subsystem &gt; Support a common framework for USB Ethernet drivers (usbnet)</li> <li>More information on the RC can be found on the <a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html" rel="nofollow" target="_blank">NetBSD 9 release page</a></li> </ul> <h2>News Roundup</h2> <h3><a href="https://www.shlomimarco.com/post/running-freenas-on-a-digitalocean-droplet" rel="nofollow" target="_blank">Running FreeNAS on a Digitalocean droplet</a></h3> <ul> <li>ZFS is awesome. FreeBSD even more so. FreeNAS is the battle-tested, enterprise-ready-yet-home-user-friendly software defined storage solution which is cooler then deep space, based on FreeBSD and makes heavy use of ZFS. This is what I (and soooooo many others) use for just about any storage-related task. I can go on and on and on about what makes it great, but if you're here, reading this, you probably know all that already and we can skip ahead.</li> <li>I've needed an offsite FreeNAS setup to replicate things to, to run some things, to do some stuff, basically, my privately-owned, tightly-controlled NAS appliance in the cloud, one I control from top to bottom and with support for whatever crazy thing I'm trying to do. Since I'm using DigitalOcean as my main VPS provider, it seemed logical to run FreeNAS there, however, you can't. While DO supports many many distos and pre-setup applications (e.g OpenVPN), FreeNAS isn't a supported feature, at least not in the traditional way :)</li> <li>Before we begin, here's the gist of what we're going to do: &gt; Base of a FreeBSD droplet, we'll re-image our boot block device with FreeNAS iso. We'll then install FreeNAS on the second block device. Once done we're going to do the ol' switcheroo: we're going to re-image our original boot block device using the now FreeNAS-installed second block device. </li> <li>Part 1: re-image our boot block device to boot FreeNAS install media.</li> <li>Part 2: Install FreeNAS on the second block-device</li> <li>Part 3: Re-image the boot block device using the FreeNAS-installed block device</li> </ul> <h3><a href="https://nomadbsd.org/" rel="nofollow" target="_blank">NomadBSD 1.3 is now available</a></h3> <ul> <li>From the release notes:</li> <li> &gt; The base system has been changed to FreeBSD 12.1-RELEASE-p1 Due to a deadlock problem, FreeBSD's unionfs has been replaced by unionfs-fuse The GPT layout has been changed to MBR. This prevents problems with Lenovo systems that refuse to boot from GPT if "lenovofix" is not set, and systems that hang on boot if "lenovofix" is set. Support for ZFS installations has been added to the NomadBSD installer. The rc-script for setting up the network interfaces has been fixed and improved. Support for setting the country code for the wlan device has been added. Auto configuration for running in VirtualBox has been added. A check for the default display has been added to the graphics configuration scripts. This fixes problems where users with Optimus have their NVIDIA card disabled, and use the integrated graphics chip instead. NVIDIA driver version 440 has been added. nomadbsd-dmconfig, a Qt tool for selecting the display manager theme, setting the default user and autologin has been added. nomadbsd-adduser, a Qt tool for added preconfigured user accounts to the system has been added. Martin Orszulik added Czech translations to the setup and installation wizard. The NomadBSD logo, designed by Ian Grindley, has been changed. Support for localized error messages has been added. Support for localizing the password prompts has been added. Some templates for starting other DEs have been added to ~/.xinitrc. The interfaces of nomadbsd-setup-gui and nomadbsd-install-gui have been improved. A script that helps users to configure a multihead systems has been added. The Xorg driver for newer Intel GPUs has been changed from "intel" to "modesetting". /proc has been added to /etc/fstab A D-Bus session issue has been fixed which prevented thunar from accessing  samba shares. DSBBg which allows users to change and manage wallpapers has been added. The latest version of update_obmenu now supports auto-updating the Openbox menu. Manually updating the Openbox menu after packet (de)installation is therefore no longer needed.</li> </ul> <blockquote> <p>Support for multiple keyboard layouts has been added.<br/>  www/palemoon has been removed.<br/>  mail/thunderbird has been removed.<br/>  audio/audacity has been added.<br/>  deskutils/orage has been added.<br/>  the password manager fpm2 has been replaced by KeePassXC<br/>  mail/sylpheed has been replaced by mail/claws-mail<br/>  multimedia/simplescreenrecorder has been added.<br/>  DSBMC has been changed to DSBMC-Qt<br/>  Many small improvements and bug fixes.</p> </blockquote> <h3><a href="https://undeadly.org/cgi?action=article;sid=20191204170908" rel="nofollow" target="_blank">At e2k19 nobody can hear you scream</a></h3> <ul> <li>After 2 years it was once again time to pack skis and snowshoes, put a satellite dish onto a sledge and hike through the snowy rockies to the Elk Lakes hut.</li> <li>I did not really have much of a plan what I wanted to work on but there were a few things I wanted to look into. One of them was rpki-client and the fact that it was so incredibly slow. Since Bob beck@ was around I started to ask him innocent X509 questions ... as if there are innocent X509 questions! Mainly about the abuse of the X509_STORE in rpki-client. Pretty soon it was clear that rpki-client did it all wrong and most of the X509 verification had to be rewritten. Instead of only storing the root certificates in the store and passing the intermediate certs as a chain to the verification function rpki-client threw everything into it. The X509_STORE is just not built for such an abuse and so it was no wonder that this was slow.</li> <li>Lucky me I pulled benno@ with me into this dark hole of libcrypto code. He managed to build up an initial diff to pass the chains as a STACK_OF(X509) and together we managed to get it working. A big thanks goes to ingo@ who documented most of the functions we had to use. Have a look at STACK_OF(3) and sk_pop_free(3) to understand why benno@ and I slowly turned crazy.</li> <li>Our next challenge was to only load the necessary certificate revocation list into the X509_STORE_CTX. While doing those changes it became obvious that some of the data structures needed better lookup functions. Looking up certificates was done using a linear lookup and so we replaced the internal certificate and CRL tables with RB trees for fast lookups. deraadt@ also joined the rpki-client commit fest and changed the output code to use rename(2) so that files are replaced in an atomic operation. Thanks to this rpki-client can now be safely run from cron (there is an example in the default crontab).</li> <li>I did not plan to spend most of my week hacking on rpki-client but in the end I'm happy that I did and the result is fairly impressive. Working with libcrypto code and especially X509 was less than pleasant. Our screams of agony died away in the snowy rocky mountains and made Bob deep dive into UVM with a smile since he knew that benno@ and I had it worse.</li> <li>In case you wonder thanks to all changes at e2k19 rpki-client improved from over 20min run time to validate all VRPS to roughly 1min to do the same job. A factor 20 improvement!</li> <li>Thanks to Theo, Bob and Howie to make this possible. To all the cooks for the great food and to Xplornet for providing us with Internet at the hut.</li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://fosdem.org/2020/schedule/track/bsd/" rel="nofollow" target="_blank">FOSDEM 2020 BSD Devroom schedule</a></li> <li><a href="https://www.freebsdfoundation.org/freebsd/how-to-guides/easy-minecraft-server-on-freebsd/" rel="nofollow" target="_blank">Easy Minecraft Server on FreeBSD Howto</a></li> <li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=355304" rel="nofollow" target="_blank">stats(3) framework in the TCP stack</a></li> <li><a href="https://twitter.com/EdwinKremer/status/1203071684535889921" rel="nofollow" target="_blank">4017 days of uptime</a></li> <li><a href="https://github.com/emilengler/sysget" rel="nofollow" target="_blank">sysget - A front-end for every package manager</a></li> <li><a href="https://www.playonbsd.com/shopping_guide/" rel="nofollow" target="_blank">PlayOnBSD’s Cross-BSD Shopping Guide</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li><a href="http://dpaste.com/2FDN26X#wrap" rel="nofollow" target="_blank">Pat asks about the proper disk drive type for ZFS</a></li> <li><a href="http://dpaste.com/2X8PBMC#wrap" rel="nofollow" target="_blank">Brad asks about a ZFS rosetta stone</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="http://www.jupiterbroadcasting.commailto:feedback@bsdnow.tv" rel="nofollow" target="_blank">feedback@bsdnow.tv</a></li> </ul> <p>          Your browser does not support the HTML5 video tag. </p><p>Special Guest: Mariusz Zaborski.</p>

Happy Holidays, All(an) | BSD Now 330

This is the best source ofBSD info available to beginners but also doesn&#39;t hesitate to dive into the interesting details holding it all together. I have found this podcast to be an essential resource for getting and staying current with tools, techniques, and community to make BSD work for me.  Thanks for putting this on!

Additionally, I think this podcast is probably the best marketing arm for the community. Keep it available!

The best beginner-accessible info for BSD

BSD Now Video Feed

The best podcast episodes about true crime. For any thrill seeking podcast listeners who just can't get enough of the captivating stories of murderers and criminals. This topic has all the best episodes from many different true crime podcasts.  Add episodes you're interested into your queue below!

Best True Crime Podcasts

The best podcast episodes of the most interesting stories and things. From skyping someone while they're in space, to tracking down and meeting a telephone scammer in person, to the story of a Galapagos. These episodes will keep you and all your friends entertained and captivated for hours. Learn something new in every episode! Add episodes you're interested into your queue below!