Linux and FreeBSD Firewalls Comparison Part 2, 27 Years with the Perfect OS, Top 20 OpenSSH Server Best Security Practices, Huge pfsync rewrite, OpenSMTPD 7.3.0p1 release, Running OpenBSD 7.3 on your laptop is really hard (not), and more NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines Linux and FreeBSD Firewalls – The Ultimate Guide - Part 2 27 Years with the Perfect OS News Roundup Top 20 OpenSSH Server Best Security Practices Huge pfsync rewrite OpenSMTPD 7.3.0p1 released Running OpenBSD 7.3 on your laptop is really hard (not) QuicSSH Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.  Feedback/Questions  Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv *** 

<p>Linux and FreeBSD Firewalls Comparison Part 2, 27 Years with the Perfect OS, Top 20 OpenSSH Server Best Security Practices, Huge pfsync rewrite, OpenSMTPD 7.3.0p1 release, Running OpenBSD 7.3 on your laptop is really hard (not), and more</p> <p><strong><em>NOTES</em></strong><br/> This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Headlines</h2> <h3><a href="https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls-part-2/" rel="nofollow" target="_blank">Linux and FreeBSD Firewalls – The Ultimate Guide - Part 2</a></h3> <h3><a href="https://peter.czanik.hu/posts/freebsd-the-perfect-os/" rel="nofollow" target="_blank">27 Years with the Perfect OS</a></h3> <h2>News Roundup</h2> <h3><a href="https://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html" rel="nofollow" target="_blank">Top 20 OpenSSH Server Best Security Practices</a></h3> <h3><a href="https://marc.info/?l=openbsd-tech&amp;m=168732121711177&amp;w=2" rel="nofollow" target="_blank">Huge pfsync rewrite</a></h3> <h3><a href="https://www.mail-archive.com/misc@opensmtpd.org/msg05909.html" rel="nofollow" target="_blank">OpenSMTPD 7.3.0p1 released</a></h3> <h3><a href="https://sohcahtoa.org.uk/openbsd.html" rel="nofollow" target="_blank">Running OpenBSD 7.3 on your laptop is really hard (not)</a></h3> <h3><a href="https://github.com/moul/quicssh" rel="nofollow" target="_blank">QuicSSH</a></h3> <h3>Tarsnap</h3> <ul> <li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> ***</li> </ul>

517: Huge pfsync rewrite

Linux and FreeBSD Firewalls Part 1, Why Netflix Chose NGINX as the Heart of Its CDN, Protect your web servers against PHP shells and malwares, Installing and running Gitlab howto, and more NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines Linux vs. FreeBSD : Linux and FreeBSD Firewalls – The Ultimate Guide : Part 1 Why Netflix Chose NGINX as the Heart of Its CDN News Roundup FreeBSD: Protect your web servers against PHP shells and malwares HowTo: Installing and running Gitlab Beastie Bits • [World built in 36 hours on a Pentium 4!](https://www.reddit.com/r/freebsd/comments/13undl9/world_built_in_36_hours_on_a_pentium_4/) • [Fart init](https://x61.sh/log/2023/05/23052023153621-fart-init.html](https://x61.sh/log/2023/05/23052023153621-fart-init.html) • [Organized Freebies](https://mwl.io/archives/22832) • [OpenSMTPD 7.3.0p0 released](http://undeadly.org/cgi?action=article;sid=20230617111340) • [shutdown/reboot now require membership of group _shutdown](http://undeadly.org/cgi?action=article;sid=20230620064255) • [Where does my computer get the time from?](https://dotat.at/@/2023-05-26-whence-time.html)  Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups. ***  Feedback/Questions  sam - fav episodes Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv *** 

<p>Linux and FreeBSD Firewalls Part 1, Why Netflix Chose NGINX as the Heart of Its CDN, Protect your web servers against PHP shells and malwares, Installing and running Gitlab howto, and more</p> <p><strong><em>NOTES</em></strong><br/> This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Headlines</h2> <h3><a href="https://klarasystems.com/articles/freebsd-linux-and-freebsd-firewalls/" rel="nofollow" target="_blank">Linux vs. FreeBSD : Linux and FreeBSD Firewalls – The Ultimate Guide : Part 1</a></h3> <h3><a href="https://www.nginx.com/blog/why-netflix-chose-nginx-as-the-heart-of-its-cdn/" rel="nofollow" target="_blank">Why Netflix Chose NGINX as the Heart of Its CDN</a></h3> <h2>News Roundup</h2> <h3><a href="https://ozgurkazancci.com/freebsd-protect-your-web-server-against-php-shells-and-malwares/" rel="nofollow" target="_blank">FreeBSD: Protect your web servers against PHP shells and malwares</a></h3> <h3><a href="https://forums.FreeBSD.org/threads/howto-installing-and-running-gitlab.89436/" rel="nofollow" target="_blank">HowTo: Installing and running Gitlab</a></h3> <h2>Beastie Bits</h2> <code>• [World built in 36 hours on a Pentium 4!](<a href="https://www.reddit.com/r/freebsd/comments/13undl9/world_built_in_36_hours_on_a_pentium_4/" rel="nofollow" target="_blank">https://www.reddit.com/r/freebsd/comments/13undl9/world_built_in_36_hours_on_a_pentium_4/</a>) • [Fart init](<a href="https://x61.sh/log/2023/05/23052023153621-fart-init.html" rel="nofollow" target="_blank">https://x61.sh/log/2023/05/23052023153621-fart-init.html</a>](<a href="https://x61.sh/log/2023/05/23052023153621-fart-init.html" rel="nofollow" target="_blank">https://x61.sh/log/2023/05/23052023153621-fart-init.html</a>) • [Organized Freebies](<a href="https://mwl.io/archives/22832" rel="nofollow" target="_blank">https://mwl.io/archives/22832</a>) • [OpenSMTPD 7.3.0p0 released](<a href="http://undeadly.org/cgi?action=article;sid=20230617111340" rel="nofollow" target="_blank">http://undeadly.org/cgi?action=article;sid=20230617111340</a>) • [shutdown/reboot now require membership of group _shutdown](<a href="http://undeadly.org/cgi?action=article;sid=20230620064255" rel="nofollow" target="_blank">http://undeadly.org/cgi?action=article;sid=20230620064255</a>) • [Where does my computer get the time from?](<a href="https://dotat.at/@/2023-05-26-whence-time.html" rel="nofollow" target="_blank">https://dotat.at/@/2023-05-26-whence-time.html</a>) </code> <h3>Tarsnap</h3> <ul> <li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups. ***</li> </ul> <h2>Feedback/Questions</h2> <ul> <li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/sam%20-%20fav%20episodes.md" rel="nofollow" target="_blank">sam - fav episodes</a></li> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> ***</li> </ul>

516: Computer Time Origins

FreeBSD or Linux – A Choice Without OS Wars, The Computer Scientist Who Can’t Stop Telling Stories, ChatGPT was asked to write a pf.conf to spec, GhostBSD 23.06.1 is now available, OPNsense 23.1.9 released, Running VSCode in Chromium on OpenBSD, and more NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines Linux vs. FreeBSD : FreeBSD or Linux – A Choice Without OS Wars The Computer Scientist Who Can’t Stop Telling Stories I asked ChatGPT to write a pf.conf to spec, 2023-06-07 version News Roundup GhostBSD 23.06.1 is now available OPNsense 23.1.9 released Running VSCode in Chromium on OpenBSD COFF: Bell Labs vs "East Coast" Management style of AT&amp;T Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.  Feedback/Questions  Matt - Wireguard Oscar - ISC.md   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv *** 

<p>FreeBSD or Linux – A Choice Without OS Wars, The Computer Scientist Who Can’t Stop Telling Stories, ChatGPT was asked to write a pf.conf to spec, GhostBSD 23.06.1 is now available, OPNsense 23.1.9 released, Running VSCode in Chromium on OpenBSD, and more</p> <p><strong><em>NOTES</em></strong><br/> This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Headlines</h2> <h3><a href="https://klarasystems.com/articles/choosing-between-freebsd-and-linux-a-choice-without-os-wars/" rel="nofollow" target="_blank">Linux vs. FreeBSD : FreeBSD or Linux – A Choice Without OS Wars</a></h3> <h3><a href="https://www.quantamagazine.org/computer-scientist-donald-knuth-cant-stop-telling-stories-20200416/" rel="nofollow" target="_blank">The Computer Scientist Who Can’t Stop Telling Stories</a></h3> <h3><a href="https://bsdly.blogspot.com/2023/06/i-asked-chatgpt-to-write-pfconf-to-spec.html" rel="nofollow" target="_blank">I asked ChatGPT to write a pf.conf to spec, 2023-06-07 version</a></h3> <h2>News Roundup</h2> <h3><a href="https://ghostbsd.org/23.06.01_iso_is_now_available" rel="nofollow" target="_blank">GhostBSD 23.06.1 is now available</a></h3> <h3><a href="https://forum.opnsense.org/index.php?topic=34282.0" rel="nofollow" target="_blank">OPNsense 23.1.9 released</a></h3> <h3><a href="https://bt.ht/vscode/" rel="nofollow" target="_blank">Running VSCode in Chromium on OpenBSD</a></h3> <h3><a href="https://www.tuhs.org/pipermail/coff/2023-May/001556.html" rel="nofollow" target="_blank">COFF: Bell Labs vs "East Coast" Management style of AT&amp;T</a></h3> <h3>Tarsnap</h3> <ul> <li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li> </ul> <h2>Feedback/Questions</h2> <ul> <li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Matt%20-%20Wiregaurd.md" rel="nofollow" target="_blank">Matt - Wireguard</a></p></li> <li><p><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/515/feedback/Oscar%20-%20ISC.md" rel="nofollow" target="_blank">Oscar - ISC.md</a></p></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> ***</li> </ul>

515: ChatGPT writing pf.conf

OpenZFS, Your Data and the Challenge of Ransomware, I Didn’t Learn Unix By Reading All The Manpages, I try to answer "how to become a systems engineer", Writing shell scripts in Nushell, Sudo and signal propagation, infecting SSH Public Keys with backdoors, OpenBSD Thinkpad, and more NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines OpenZFS, Your Data and the Challenge of Ransomware I Didn’t Learn Unix By Reading All The Manpages News Roundup Feedback: I try to answer "how to become a systems engineer" Writing shell scripts in Nushell Sudo and signal propagation Infecting SSH Public Keys with backdoors OpenBSD Thinkpad Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.  Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv  

<p>OpenZFS, Your Data and the Challenge of Ransomware, I Didn’t Learn Unix By Reading All The Manpages, I try to answer "how to become a systems engineer", Writing shell scripts in Nushell, Sudo and signal propagation, infecting SSH Public Keys with backdoors, OpenBSD Thinkpad, and more</p> <p><strong><em>NOTES</em></strong><br/> This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Headlines</h2> <h3><a href="https://klarasystems.com/articles/openzfs-openzfs-your-data-and-the-challenge-of-ransomware/" rel="nofollow" target="_blank">OpenZFS, Your Data and the Challenge of Ransomware</a></h3> <h3><a href="https://www.owlfolio.org/research/i-didnt-learn-unix-by-reading-all-the-manpages/" rel="nofollow" target="_blank">I Didn’t Learn Unix By Reading All The Manpages</a></h3> <h2>News Roundup</h2> <h3><a href="https://rachelbythebay.com/w/2023/05/30/eng/" rel="nofollow" target="_blank">Feedback: I try to answer "how to become a systems engineer"</a></h3> <h3><a href="https://jpospisil.com/2023/05/25/writing-shell-scripts-in-nushell" rel="nofollow" target="_blank">Writing shell scripts in Nushell</a></h3> <h3><a href="https://dxuuu.xyz/sudo.html" rel="nofollow" target="_blank">Sudo and signal propagation</a></h3> <h3><a href="https://blog.thc.org/infecting-ssh-public-keys-with-backdoors" rel="nofollow" target="_blank">Infecting SSH Public Keys with backdoors</a></h3> <h3><a href="https://douglasrumbaugh.com/post/openbsd-thinkpad-good/" rel="nofollow" target="_blank">OpenBSD Thinkpad</a></h3> <h3>Tarsnap</h3> <ul> <li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p> </li> <li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p> </li> </ul>

514: Infecting Public Keys

We have a new show host, Understanding ZFS vdev Types, Don't abuse su for dropping user privileges, Dynamic Tracing on OpenBSD 7.3, new Libressl, Manual Jails on FreeBSD 12, and more NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Host Introductions - Jason Tubnor - https://www.tubsta.com / @tubsta / @Tubsta@soc.feditime.com Headlines Understanding ZFS vdev Types Don't abuse su for dropping user privileges News Roundup Dynamic Tracing on OpenBSD 7.3 new Libressl Manual Jails on FreeBSD 12 Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.  Feedback/Questions  Chris - questions Dan - zfs questions Pablo - Jail question   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv***

<p>We have a new show host, Understanding ZFS vdev Types, Don't abuse su for dropping user privileges, Dynamic Tracing on OpenBSD 7.3, new Libressl, Manual Jails on FreeBSD 12, and more</p> <p><strong><em>NOTES</em></strong></p> <p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Host Introductions - Jason Tubnor - <a href="https://www.tubsta.com" rel="nofollow" target="_blank">https://www.tubsta.com</a> / <a href="https://twitter.com/tubsta" rel="nofollow" target="_blank">@tubsta</a> / <a href="https://soc.feditime.com" rel="nofollow" target="_blank">@Tubsta@soc.feditime.com</a></h2> <h2>Headlines</h2> <h3><a href="https://klarasystems.com/articles/openzfs-understanding-zfs-vdev-types/" rel="nofollow" target="_blank">Understanding ZFS vdev Types</a></h3> <h3><a href="https://jdebp.uk/FGA/dont-abuse-su-for-dropping-privileges.html" rel="nofollow" target="_blank">Don't abuse su for dropping user privileges</a></h3> <h2>News Roundup</h2> <h3><a href="https://blog.lambda.cx/posts/openbsd-dynamic-tracing/" rel="nofollow" target="_blank">Dynamic Tracing on OpenBSD 7.3</a></h3> <h3><a href="https://undeadly.org/cgi?action=article;sid=20230528115900" rel="nofollow" target="_blank">new Libressl</a></h3> <h3><a href="https://ogris.de/howtos/freebsd-jails.html" rel="nofollow" target="_blank">Manual Jails on FreeBSD 12</a></h3> <h3>Tarsnap</h3> <ul> <li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li> </ul> <h2>Feedback/Questions</h2> <ul> <li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Chris%20-%20questions.md" rel="nofollow" target="_blank">Chris - questions</a></li> <li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Dan%20-%20zfs%20questions.md" rel="nofollow" target="_blank">Dan - zfs questions</a></li> <li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/513/feedback/Pablo%20-%20Jail%20question.md" rel="nofollow" target="_blank">Pablo - Jail question</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a><br>***</li></ul>

513: New Host Interview

Recorded at BSDCan 2023 NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines BSDNow - The early years BSDNow - Production Process News Roundup FreeBSD Devsummit BSDCan Beastie Bits   How you can help the show!  Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.  Feedback/Questions  Corey asks - what is the status of netbsd 10? How have things changed in the bsds over the history of the show?  Announcement As a final thing Allan would like to make an announcement: - Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv

<p>Recorded at BSDCan 2023</p> <p><strong><em>NOTES</em></strong></p> <p>This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Headlines</h2> <h3>BSDNow - The early years</h3> <h2>BSDNow - Production Process</h2> <h2>News Roundup</h2> <h3>FreeBSD Devsummit</h3> <h3>BSDCan</h3> <h2>Beastie Bits</h2> <ul> <li> How you can help the show!</li> </ul> <h3>Tarsnap</h3> <ul> <li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Corey asks - what is the status of netbsd 10?</li> <li>How have things changed in the bsds over the history of the show?</li> </ul> <h2>Announcement</h2> <p>As a final thing Allan would like to make an announcement:</p> <h2>- Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></h2>

512: BSDNow Live! 9 bits of BSDNow - Just speak into the goat

Sun Ray laptops, MIPS and getting root on them, OpenZFS for HPC Clusters, Self-Hosted Bookmarks using DAV and httpd on OpenBSD, Terraform + Proxmox + OpenBSD = &lt;3, WOL Plex Server, Against innovation, and more NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines Of Sun Ray laptops, MIPS and getting root on them OpenZFS for HPC Clusters News Roundup Self-Hosted Bookmarks using DAV and httpd on OpenBSD Terraform + Proxmox + OpenBSD = &lt;3 WOL Plex Server Against Innovation Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv 

<p>Sun Ray laptops, MIPS and getting root on them, OpenZFS for HPC Clusters, Self-Hosted Bookmarks using DAV and httpd on OpenBSD, Terraform + Proxmox + OpenBSD = &lt;3, WOL Plex Server, Against innovation, and more</p> <p><strong><em>NOTES</em></strong><br/> This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Headlines</h2> <h3><a href="https://oldvcr.blogspot.com/2023/04/of-sun-ray-laptops-mips-and-getting.html" rel="nofollow" target="_blank">Of Sun Ray laptops, MIPS and getting root on them</a></h3> <h3><a href="https://klarasystems.com/articles/openzfs-openzfs-for-hpc-clusters/" rel="nofollow" target="_blank">OpenZFS for HPC Clusters</a></h3> <h2>News Roundup</h2> <h3><a href="https://www.tumfatig.net/2023/self-hosted-bookmarks-using-dav-and-httpd-on-openbsd/" rel="nofollow" target="_blank">Self-Hosted Bookmarks using DAV and httpd on OpenBSD</a></h3> <h3><a href="https://x61.sh/log/2023/05/19052023172439-terraform_proxmox_openbsd.html" rel="nofollow" target="_blank">Terraform + Proxmox + OpenBSD = &lt;3</a></h3> <h3><a href="https://maximiliangolla.com/blog/2022-10-wol-plex-server/" rel="nofollow" target="_blank">WOL Plex Server</a></h3> <h3><a href="https://dadadrummer.substack.com/p/against-innovation" rel="nofollow" target="_blank">Against Innovation</a></h3> <h3>Tarsnap</h3> <ul> <li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li> </ul>

511: Against Innovation

AsiaBSDCon 2023 Trip Report, Converting My X201 ThinkPad into a Slabtop, Stream your OpenBSD desktop audio to other devices, The Gnome and Its "Secret Place", ttyload, and more NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines AsiaBSDCon 2023 Trip Report Converting My X201 ThinkPad into a Slabtop News Roundup Stream your OpenBSD desktop audio to other devices The Gnome and Its "Secret Place" ttyload - Linux/Unix color-coded graphical tracking tool for load average in a terminal Beastie Bits • [OpenIndiana with a Sun Microsystems 22" LCD monitor. Running on a 1.8GHz quad core AMD Phenom 9100e processor, 4Gb RAM, nVidia GEForce GT630.](https://www.reddit.com/r/unix/comments/13otjnt/openindiana_with_a_sun_microsystems_22_lcd/) • [cron(8) now supports random ranges with steps](https://www.undeadly.org/cgi?action=article;sid=20230507122935&amp;utm_source=bsdweekly) • [BSDCan 2024 Reorganization](https://mwl.io/archives/22799) • [Depenguin me](https://depenguin.me/)  Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv 

<p>AsiaBSDCon 2023 Trip Report, Converting My X201 ThinkPad into a Slabtop, Stream your OpenBSD desktop audio to other devices, The Gnome and Its "Secret Place", ttyload, and more</p> <p><strong><em>NOTES</em></strong><br/> This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Headlines</h2> <h3><a href="https://freebsdfoundation.org/blog/asiabsdcon-2023-trip-report/" rel="nofollow" target="_blank">AsiaBSDCon 2023 Trip Report</a></h3> <h3><a href="https://bt.ht/slabtop/" rel="nofollow" target="_blank">Converting My X201 ThinkPad into a Slabtop</a></h3> <h2>News Roundup</h2> <h3><a href="https://dataswamp.org/%7Esolene/2023-05-05-openbsd-sound-streaming.html" rel="nofollow" target="_blank">Stream your OpenBSD desktop audio to other devices</a></h3> <h3><a href="https://www.tuhs.org/pipermail/tuhs/2023-May/028363.html" rel="nofollow" target="_blank">The Gnome and Its "Secret Place"</a></h3> <h3><a href="https://www.cyberciti.biz/open-source/command-line-hacks/ttyload-color-coded-graphical-tracking-tool-for-unixlinux-load-average-in-a-terminal/" rel="nofollow" target="_blank">ttyload - Linux/Unix color-coded graphical tracking tool for load average in a terminal</a></h3> <h2>Beastie Bits</h2> <code>• [OpenIndiana with a Sun Microsystems 22" LCD monitor. Running on a 1.8GHz quad core AMD Phenom 9100e processor, 4Gb RAM, nVidia GEForce GT630.](<a href="https://www.reddit.com/r/unix/comments/13otjnt/openindiana_with_a_sun_microsystems_22_lcd/" rel="nofollow" target="_blank">https://www.reddit.com/r/unix/comments/13otjnt/openindiana_with_a_sun_microsystems_22_lcd/</a>) • [cron(8) now supports random ranges with steps](<a href="https://www.undeadly.org/cgi?action=article;sid=20230507122935&amp;utm_source=bsdweekly" rel="nofollow" target="_blank">https://www.undeadly.org/cgi?action=article;sid=20230507122935&amp;utm_source=bsdweekly</a>) • [BSDCan 2024 Reorganization](<a href="https://mwl.io/archives/22799" rel="nofollow" target="_blank">https://mwl.io/archives/22799</a>) • [Depenguin me](<a href="https://depenguin.me/" rel="nofollow" target="_blank">https://depenguin.me/</a>) </code> <h3>Tarsnap</h3> <ul> <li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li> </ul>

510: The BSD Slabtop

Leveraging OpenZFS to Build Your Own Storage Appliance, Install OpenBSD as a VM, Set up your own CalDAV and CardDAV servers on OpenBSD, display basic computer information using DMI table decoder, Gpart CheatSheet, Rob Pike on the Origin of Unix Dot File Names, and more NOTES This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines OpenZFS – Leveraging OpenZFS to Build Your Own Storage Appliance Install OpenBSD as a VM News Roundup Set up your own CalDAV and CardDAV servers on OpenBSD How to display basic computer information using DMI table decoder Gpart CheatSheet - wiping drives, partitioning, &amp; formating Rob Pike on the Origin of Unix Dot File Names Beastie Bits  Hackerstations   Mike McQuaid's clean, ergonomic setup in Edinburgh, Scotland Daniel Stenberg and the home of curl in Stockholm, Sweden  viogpu(4), a VirtIO GPU driver, added to -current OpenBGPD 8.0 released cron(8) now supports random ranges with steps malloc leak detection available in -current vmd(8) moves to a multi-process model  Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups. Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv  

<p>Leveraging OpenZFS to Build Your Own Storage Appliance, Install OpenBSD as a VM, Set up your own CalDAV and CardDAV servers on OpenBSD, display basic computer information using DMI table decoder, Gpart CheatSheet, Rob Pike on the Origin of Unix Dot File Names, and more</p> <p><strong><em>NOTES</em></strong><br/> This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Headlines</h2> <h3><a href="https://klarasystems.com/articles/openzfs-leveraging-openzfs-to-build-your-own-storage-appliance/" rel="nofollow" target="_blank">OpenZFS – Leveraging OpenZFS to Build Your Own Storage Appliance</a></h3> <h3><a href="https://byte-sized.de/linux-unix/openbsd-als-vm-installieren/#english" rel="nofollow" target="_blank">Install OpenBSD as a VM</a></h3> <h2>News Roundup</h2> <h3><a href="https://dataswamp.org/%7Esolene/2023-04-23-calendar-and-contacts-with-radicale.html" rel="nofollow" target="_blank">Set up your own CalDAV and CardDAV servers on OpenBSD</a></h3> <h3><a href="https://sleeplessbeastie.eu/2023/03/31/how-to-display-basic-computer-information-using-dmi-table-decoder/" rel="nofollow" target="_blank">How to display basic computer information using DMI table decoder</a></h3> <h3><a href="https://forums.FreeBSD.org/threads/gpart-cheatsheet-wiping-drives-partitioning-formating.45411" rel="nofollow" target="_blank">Gpart CheatSheet - wiping drives, partitioning, &amp; formating</a></h3> <h3><a href="http://xahlee.info/UnixResource_dir/writ/unix_origin_of_dot_filename.html" rel="nofollow" target="_blank">Rob Pike on the Origin of Unix Dot File Names</a></h3> <h2>Beastie Bits</h2> <ul> <li>Hackerstations  <ul> <li><a href="https://hackerstations.com/setups/mike_mcquaid/" rel="nofollow" target="_blank">Mike McQuaid's clean, ergonomic setup in Edinburgh, Scotland</a></li> <li><a href="https://hackerstations.com/setups/daniel_stenberg/" rel="nofollow" target="_blank">Daniel Stenberg and the home of curl in Stockholm, Sweden</a></li> </ul></li> <li><p><a href="http://undeadly.org/cgi?action=article;sid=20230421124221" rel="nofollow" target="_blank">viogpu(4), a VirtIO GPU driver, added to -current</a></p></li> <li><p><a href="http://undeadly.org/cgi?action=article;sid=20230505054214" rel="nofollow" target="_blank">OpenBGPD 8.0 released</a></p></li> <li><p><a href="http://undeadly.org/cgi?action=article;sid=20230507122935" rel="nofollow" target="_blank">cron(8) now supports random ranges with steps</a></p></li> <li><p><a href="http://undeadly.org/cgi?action=article;sid=20230417074903" rel="nofollow" target="_blank">malloc leak detection available in -current</a></p></li> <li><p><a href="https://www.undeadly.org/cgi?action=article;sid=20230430051250" rel="nofollow" target="_blank">vmd(8) moves to a multi-process model</a></p></li> </ul> <h3>Tarsnap</h3> <ul> <li><p>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</p></li> <li><p>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></p> </li> </ul>

509: Dot File Naming

FreeBSD Foundation Welcomes New Team Members, OpenZFS the Ideal Storage Solution for University Environments, SCaLE20X Conference Report, 916 days of Emacs, XTerm: It's Better Than You Thought, NetBSD Annual General Meeting 2023, and more NOTES** This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon Headlines FreeBSD Foundation Welcomes New Team Members What Makes OpenZFS the Ideal Storage Solution for University Environments News Roundup SCaLE20X Conference Report 916 days of Emacs XTerm: It's Better Than You Thought NetBSD AGM2023: Annual General Meeting, May 13, 21:00 UTC Tarsnap  This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.  Feedback/Questions  Adrian - Tilde Dan - Root Shell Florian - Salt Extension   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv *** 

<p>FreeBSD Foundation Welcomes New Team Members, OpenZFS the Ideal Storage Solution for University Environments, SCaLE20X Conference Report, 916 days of Emacs, XTerm: It's Better Than You Thought, NetBSD Annual General Meeting 2023, and more</p> <p><em>NOTES</em>**<br/> This episode of BSDNow is brought to you by <a href="https://www.tarsnap.com/bsdnow" rel="nofollow" target="_blank">Tarsnap</a> and the <a href="https://www.patreon.com/bsdnow" rel="nofollow" target="_blank">BSDNow Patreon</a></p> <h2>Headlines</h2> <h3><a href="https://freebsdfoundation.org/blog/freebsd-foundation-welcomes-new-team-members/" rel="nofollow" target="_blank">FreeBSD Foundation Welcomes New Team Members</a></h3> <h3><a href="https://klarasystems.com/articles/openzfs-what-makes-openzfs-the-ideal-storage-solution-for-university-environments//" rel="nofollow" target="_blank">What Makes OpenZFS the Ideal Storage Solution for University Environments</a></h3> <h2>News Roundup</h2> <h3><a href="https://freebsdfoundation.org/blog/scale20x-conference-report/" rel="nofollow" target="_blank">SCaLE20X Conference Report</a></h3> <h3><a href="https://sqrtminusone.xyz/posts/2023-04-13-emacs/" rel="nofollow" target="_blank">916 days of Emacs</a></h3> <h3><a href="https://aduros.com/blog/xterm-its-better-than-you-thought/" rel="nofollow" target="_blank">XTerm: It's Better Than You Thought</a></h3> <h3><a href="https://mail-index.netbsd.org/netbsd-announce/2023/05/05/msg000348.html" rel="nofollow" target="_blank">NetBSD AGM2023: Annual General Meeting, May 13, 21:00 UTC</a></h3> <h3>Tarsnap</h3> <ul> <li>This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.</li> </ul> <h2>Feedback/Questions</h2> <ul> <li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Adrian%20-%20Tilde.md" rel="nofollow" target="_blank">Adrian - Tilde</a></li> <li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Dan%20-%20Root%20Shell.md" rel="nofollow" target="_blank">Dan - Root Shell</a></li> <li><a href="https://github.com/BSDNow/bsdnow.tv/blob/master/episodes/508/feedback/Florian%20-%20Salt%20Extension.md" rel="nofollow" target="_blank">Florian - Salt Extension</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> ***</li> </ul>

508: Foundational Proceedings

Created by three guys who love BSD, we cover the latest news and have an extensive series of tutorials, as well as interviews with various people from all areas of the BSD community. It also serves as a platform for support and questions. We love and advocate FreeBSD, OpenBSD, NetBSD, DragonFlyBSD and TrueOS. Our show aims to be helpful and informative for new users that want to learn about them, but still be entertaining for the people who are already pros.The show airs on Wednesdays at 2:00PM (US Eastern time) and the edited version is usually up the following day.

They don&#39;t just cover the BSDs, but the wider Unix world as well. Great topics, technical analysis, and interviews. One of the best Unix/BSD podcasts currently out there.

Great for keeping up wth BSDs and Unix

This is the best source ofBSD info available to beginners but also doesn&#39;t hesitate to dive into the interesting details holding it all together. I have found this podcast to be an essential resource for getting and staying current with tools, techniques, and community to make BSD work for me.  Thanks for putting this on!

Additionally, I think this podcast is probably the best marketing arm for the community. Keep it available!

Best beginner-accessible BSD resource anywhere!

Created by three guys who love BSD, we cover the latest news and have an extensive series of tutorials, as well as interviews with various people from all areas of the BSD community. It also serves as a platform for support and questions. We love and advocate FreeBSD, OpenBSD, NetBSD, DragonFlyBSD and TrueOS. Our show aims to be helpful and informative for new users that want to learn about them, but still be entertaining for the people who are already pros.<br>The show airs on Wednesdays at 2:00PM (US Eastern time) and the edited version is usually up the following day.

BSD Now

Episode 250: BSDCan 2018 Recap | BSD Now 250

Arcan and OpenBSD, running OpenBSD 6.3 on RPI 3, why C is not a low-level language, HardenedBSD switching back to OpenSSL, how the Internet was almost broken, EuroBSDcon CfP is out, and the BSDCan 2018 schedule is available. Headlines Towards Secure System Graphics: Arcan and OpenBSD  Let me preface this by saying that this is a (very) long and medium-rare technical article about the security considerations and minutiae of porting (most of) the Arcan ecosystem to work under OpenBSD. The main point of this article is not so much flirting with the OpenBSD crowd or adding further noise to software engineering topics, but to go through the special considerations that had to be taken, as notes to anyone else that decides to go down this overgrown and lonesome trail, or are curious about some less than obvious differences between how these things “work” on Linux vs. other parts of the world. A disclaimer is also that most of this have been discovered by experimentation and combining bits and pieces scattered in everything from Xorg code to man pages, there may be smarter ways to solve some of the problems mentioned – this is just the best I could find within the time allotted. I’d be happy to be corrected, in patch/pull request form that is 😉 Each section will start with a short rant-like explanation of how it works in Linux, and what the translation to OpenBSD involved or, in the cases that are still partly or fully missing, will require. The topics that will be covered this time are:   Graphics Device Access Hotplug Input Backlight Xorg Pledging Missing   Installing OpenBSD 6.3 (snapshots) on Raspberry pi 3  The Easy way   Installing the OpenBSD on raspberry pi 3 is very easy and well documented which almost convinced me of not writing about it, but still I felt like it may help somebody new to the project (But again I really recommend reading the document if you are interested and have the time). Note: I'm always running snapshots and recommend anybody to do it as well. But the snapshots links will change to the next version every 6 month, so I changed the links to the 6.3 version to keep the blog post valid over times. If you're familiar to the OpenBSD flavors, feel free to use the snapshots links instead.   Requirements   Due to the lack of driver, the OpenBSD can not boot directly from the SD Card yet, So we'll need an USB Stick for the installtion target aside the SD Card for the U-Boot and installer. Also, a Serial Console connection is required. I Used a PL2303 USB to Serial (TTL) adapter connected to my Laptop via USB port and connected to the Raspberry via TX, RX and GND pins.   iXsystems https://www.ixsystems.com/blog/truenas-m-series-veeam-pr-2018/ Why Didn’t Larrabee Fail?  Every month or so, someone will ask me what happened to Larrabee and why it failed so badly. And I then try to explain to them that not only didn't it fail, it was a pretty huge success. And they are understandably very puzzled by this, because in the public consciousness Larrabee was like the Itanic and the SPU rolled into one, wasn't it? Well, not quite. So rather than explain it in person a whole bunch more times, I thought I should write it down. This is not a history, and I'm going to skip a TON of details for brevity. One day I'll write the whole story down, because it's a pretty decent escapade with lots of fun characters. But not today. Today you just get the very start and the very end. When I say "Larrabee" I mean all of Knights, all of MIC, all of Xeon Phi, all of the "Isle" cards - they're all exactly the same chip and the same people and the same software effort. Marketing seemed to dream up a new codeword every week, but there was only ever three chips:   Knights Ferry / Aubrey Isle / LRB1 - mostly a prototype, had some performance gotchas, but did work, and shipped to partners. Knights Corner / Xeon Phi / LRB2 - the thing we actually shipped in bulk. Knights Landing - the new version that is shipping any day now (mid 2016).   That's it. There were some other codenames I've forgotten over the years, but they're all of one of the above chips. Behind all the marketing smoke and mirrors there were only three chips ever made (so far), and only four planned in total (we had a thing called LRB3 planned between KNC and KNL for a while). All of them are "Larrabee", whether they do graphics or not. When Larrabee was originally conceived back in about 2005, it was called "SMAC", and its original goals were, from most to least important:   Make the most powerful flops-per-watt machine for real-world workloads using a huge array of simple cores, on systems and boards that could be built into bazillo-core supercomputers. Make it from x86 cores. That means memory coherency, store ordering, memory protection, real OSes, no ugly scratchpads, it runs legacy code, and so on. No funky DSPs or windowed register files or wacky programming models allowed. Do not build another Itanium or SPU! Make it soon. That means keeping it simple. Support the emerging GPGPU market with that same chip. Intel were absolutely not going to build a 150W PCIe card version of their embedded graphics chip (known as "Gen"), so we had to cover those programming models. As a bonus, run normal graphics well. Add as little graphics-specific hardware as you can get away with.   That ordering is important - in terms of engineering and focus, Larrabee was never primarily a graphics card. If Intel had wanted a kick-ass graphics card, they already had a very good graphics team begging to be allowed to build a nice big fat hot discrete GPU - and the Gen architecture is such that they'd build a great one, too. But Intel management didn't want one, and still doesn't. But if we were going to build Larrabee anyway, they wanted us to cover that market as well. ... the design of Larrabee was of a CPU with a very wide SIMD unit, designed above all to be a real grown-up CPU - coherent caches, well-ordered memory rules, good memory protection, true multitasking, real threads, runs Linux/FreeBSD, etc. Larrabee, in the form of KNC, went on to become the fastest supercomputer in the world for a couple of years, and it's still making a ton of money for Intel in the HPC market that it was designed for, fighting very nicely against the GPUs and other custom architectures. Its successor, KNL, is just being released right now (mid 2016) and should do very nicely in that space too. Remember - KNC is literally the same chip as LRB2. It has texture samplers and a video out port sitting on the die. They don't test them or turn them on or expose them to software, but they're still there - it's still a graphics-capable part. But it's still actually running FreeBSD on that card, and under FreeBSD it's just running an x86 program called DirectXGfx (248 threads of it).   News Roundup C Is Not a Low-level Language : Your computer is not a fast PDP-11.  In the wake of the recent Meltdown and Spectre vulnerabilities, it's worth spending some time looking at root causes. Both of these vulnerabilities involved processors speculatively executing instructions past some kind of access check and allowing the attacker to observe the results via a side channel. The features that led to these vulnerabilities, along with several others, were added to let C programmers continue to believe they were programming in a low-level language, when this hasn't been the case for decades. Processor vendors are not alone in this. Those of us working on C/C++ compilers have also participated.   What Is a Low-Level Language?   Computer science pioneer Alan Perlis defined low-level languages this way: "A programming language is low level when its programs require attention to the irrelevant." While, yes, this definition applies to C, it does not capture what people desire in a low-level language. Various attributes cause people to regard a language as low-level. Think of programming languages as belonging on a continuum, with assembly at one end and the interface to the Starship Enterprise's computer at the other. Low-level languages are "close to the metal," whereas high-level languages are closer to how humans think. For a language to be "close to the metal," it must provide an abstract machine that maps easily to the abstractions exposed by the target platform. It's easy to argue that C was a low-level language for the PDP-11. They both described a model in which programs executed sequentially, in which memory was a flat space, and even the pre- and post-increment operators cleanly lined up with the PDP-11 addressing modes.  Fast PDP-11 Emulators  The root cause of the Spectre and Meltdown vulnerabilities was that processor architects were trying to build not just fast processors, but fast processors that expose the same abstract machine as a PDP-11. This is essential because it allows C programmers to continue in the belief that their language is close to the underlying hardware. C code provides a mostly serial abstract machine (until C11, an entirely serial machine if nonstandard vendor extensions were excluded). Creating a new thread is a library operation known to be expensive, so processors wishing to keep their execution units busy running C code rely on ILP (instruction-level parallelism). They inspect adjacent operations and issue independent ones in parallel. This adds a significant amount of complexity (and power consumption) to allow programmers to write mostly sequential code. In contrast, GPUs achieve very high performance without any of this logic, at the expense of requiring explicitly parallel programs. The quest for high ILP was the direct cause of Spectre and Meltdown. A modern Intel processor has up to 180 instructions in flight at a time (in stark contrast to a sequential C abstract machine, which expects each operation to complete before the next one begins). A typical heuristic for C code is that there is a branch, on average, every seven instructions. If you wish to keep such a pipeline full from a single thread, then you must guess the targets of the next 25 branches. This, again, adds complexity; it also means that an incorrect guess results in work being done and then discarded, which is not ideal for power consumption. This discarded work has visible side effects, which the Spectre and Meltdown attacks could exploit. On a modern high-end core, the register rename engine is one of the largest consumers of die area and power. To make matters worse, it cannot be turned off or power gated while any instructions are running, which makes it inconvenient in a dark silicon era when transistors are cheap but powered transistors are an expensive resource. This unit is conspicuously absent on GPUs, where parallelism again comes from multiple threads rather than trying to extract instruction-level parallelism from intrinsically scalar code. If instructions do not have dependencies that need to be reordered, then register renaming is not necessary. Consider another core part of the C abstract machine's memory model: flat memory. This hasn't been true for more than two decades. A modern processor often has three levels of cache in between registers and main memory, which attempt to hide latency. The cache is, as its name implies, hidden from the programmer and so is not visible to C. Efficient use of the cache is one of the most important ways of making code run quickly on a modern processor, yet this is completely hidden by the abstract machine, and programmers must rely on knowing implementation details of the cache (for example, two values that are 64-byte-aligned may end up in the same cache line) to write efficient code.   Backup URL Hacker News Commentary   HardenedBSD Switching Back to OpenSSL  Over a year ago, HardenedBSD switched to LibreSSL as the default cryptographic library in base for 12-CURRENT. 11-STABLE followed suit later on. Bernard Spil has done an excellent job at keeping our users up-to-date with the latest security patches from LibreSSL. After recently updating 12-CURRENT to LibreSSL 2.7.2 from 2.6.4, it has become increasingly clear to us that performing major upgrades requires a team larger than a single person. Upgrading to 2.7.2 caused a lot of fallout in our ports tree. As of 28 Apr 2018, several ports we consider high priority are still broken. As it stands right now, it would take Bernard a significant amount of his spare personal time to fix these issues. Until we have a multi-person team dedicated to maintaining LibreSSL in base along with the patches required in ports, HardenedBSD will use OpenSSL going forward as the default cryptographic library in base. LibreSSL will co-exist with OpenSSL in the source tree, as it does now. However, MK_LIBRESSL will default to "no" instead of the current "yes". Bernard will continue maintaining LibreSSL in base along with addressing the various problematic ports entries. To provide our users with ample time to plan and perform updates, we will wait a period of two months prior to making the switch. The switch will occur on 01 Jul 2018 and will be performed simultaneously in 12-CURRENT and 11-STABLE. HardenedBSD will archive a copy of the LibreSSL-centric package repositories and binary updates for base for a period of six months after the switch (expiring the package repos on 01 Jan 2019). This essentially gives our users eight full months for an upgrade path. As part of the switch back to OpenSSL, the default NTP daemon in base will switch back from OpenNTPd to ISC NTP. Users who have localopenntpdenable="YES" set in rc.conf will need to switch back to ntpd_enable="YES". Users who build base from source will want to fully clean their object directories. Any and all packages that link with libcrypto or libssl will need to be rebuilt or reinstalled. With the community's help, we look forward to the day when we can make the switch back to LibreSSL. We at HardenedBSD believe that providing our users options to rid themselves of software monocultures can better increase security and manage risk.   DigitalOcean http://do.co/bsdnow -- $100 credit for 60 days How Dan Kaminsky Almost Broke the Internet  In the summer of 2008, security researcher Dan Kaminsky disclosed how he had found a huge flaw in the Internet that could let attackers redirect web traffic to alternate servers and disrupt normal operations. In this Hacker History video, Kaminsky describes the flaw and notes the issue remains unfixed. “We were really concerned about web pages and emails 'cause that’s what you get to compromise when you compromise DNS,” Kaminsky says. “You think you’re sending an email to IBM but it really goes to the bad guy.” As the phone book of the Internet, DNS translates easy-to-remember domain names into IP addresses so that users don’t have to remember strings of numbers to reach web applications and services. Authoritative nameservers publish the IP addresses of domain names. Recursive nameservers talk to authoritative servers to find addresses for those domain names and saves the information into its cache to speed up the response time the next time it is asked about that site. While anyone can set up a nameserver and configure an authoritative zone for any site, if recursive nameservers don’t point to it to ask questions, no one will get those wrong answers. We made the Internet less flammable. Kaminsky found a fundamental design flaw in DNS that made it possible to inject incorrect information into the nameserver's cache, or DNS cache poisoning. In this case, if an attacker crafted DNS queries looking for sibling names to existing domains, such as 1.example.com, 2.example.com, and 3.example.com, while claiming to be the official "www" server for example.com, the nameserver will save that server IP address for “www” in its cache. “The server will go, ‘You are the official. Go right ahead. Tell me what it’s supposed to be,’” Kaminsky says in the video. Since the issue affected nearly every DNS server on the planet, it required a coordinated response to address it. Kaminsky informed Paul Vixie, creator of several DNS protocol extensions and application, and Vixie called an emergency summit of major IT vendors at Microsoft’s headquarters to figure out what to do. The “fix” involved combining the 16-bit transaction identifier that DNS lookups used with UDP source ports to create 32-bit transaction identifiers. Instead of fixing the flaw so that it can’t be exploited, the resolution focused on making it take more than ten seconds, eliminating the instantaneous attack. “[It’s] not like we repaired DNS,” Kaminsky says. “We made the Internet less flammable.” DNSSEC (Domain Name System Security Extensions), is intended to secure DNS by adding a cryptographic layer to DNS information. The root zone of the internet was signed for DNSSEC in July 2010 and the .com Top Level Domain (TLD) was finally signed for DNSSEC in April 2011. Unfortunately, adoption has been slow, even ten years after Kaminsky first raised the alarm about DNS, as less than 15 percent of users pass their queries to DNSSEC validating resolvers. The Internet was never designed to be secure. The Internet was designed to move pictures of cats. No one expected the Internet to be used for commerce and critical communications. If people lose faith in DNS, then all the things that depend on it are at risk. “What are we going to do? Here is the answer. Some of us gotta go out fix it,” Kaminsky says.   OpenIndiana Hipster 2018.04 is here  We have released a new OpenIndiana Hipster snapshot 2018.04. The noticeable changes: Userland software is rebuilt with GCC 6. KPTI was enabled to mitigate recent security issues in Intel CPUs. Support of Gnome 2 desktop was removed. Linked images now support zoneproxy service. Mate desktop applications are delivered as 64-bit-only. Upower support was integrated. IIIM was removed. More information can be found in 2018.04 Release notes and new medias can be downloaded from http://dlc.openindiana.org.   Beastie Bits  EuroBSDCon - Call for Papers OpenSSH 7.7 pkgsrc-2018Q1 released BSDCan Schedule Michael Dexter's LFNW talk    Tarsnap ad  Feedback/Questions  Bob - Help locating FreeBSD Help Alex - Convert directory to dataset Adam - FreeNAS Question Florian - Three Questions    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv   iX Ad spot: iXsystems TrueNAS M-Series Blows Away Veeam Backup Certification Tests

Episode 244: C is a Lie | BSD Now 244

OpenBSD 6.5 has been released, mount ZFS datasets anywhere, help test upcoming NetBSD 9 branch, LibreSSL 2.9.1 is available, Bail Bond Denied Edition of FreeBSD Mastery: Jails, and one reason ed(1) was a good editor back in the days in this week’s episode. Headlines OpenBSD 6.5 Released  Changelog Mirrors 6.5 Includes OpenSMTPD 6.5.0 LibreSSL 2.9.1 OpenSSH 8.0 Mandoc 1.14.5 Xenocara LLVM/Clang 7.0.1 (+ patches) GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)  Many pre-built packages for each architecture: aarch64: 9654 amd64: 10602 i386: 10535    Mount your ZFS datasets anywhere you want  ZFS is very flexible about mountpoints, and there are many features available to provide great flexibility.  When you create zpool maintank, the default mountpoint is /maintank.  You might be happy with that, but you don’t have to be content. You can do magical things.   Some highlights are: mount point can be inherited not all filesystems in a zpool need to be mounted each filesystem (directory) can have different ZFS characteristics In my case, let’s look at this new zpool I created earlier today and I will show you some very simple alternatives. This zpool use NVMe devices which should be faster than SSDs especially when used with multiple concurrent writes. This is my plan: run all the Bacula regression tests concurrently.    News Roundup Branch for netbsd 9 upcoming, please help and test -current  Folks,  once again we are quite late for branching the next NetBSD release (NetBSD 9).  Initially planned to happen early in February 2019, we are now approaching May and it is unlikely that the branch will happen before that.  On the positive side, lots of good things landed in -current in between, like new Mesa, new jemalloc, lots of ZFS improvements - and some of those would be hard to pull up to the branch later.  On the bad side we saw lots of churn in -current recently, and there is quite  some fallout where we not even have a good overview right now. And this is where  you can help:  please test -current, on all the various machines you have especially interesting would be test results from uncommon architectures  or strange combinations (like the sparc userland on sparc64 kernel issue  I ran in yesterday)  Please test, report success, and file PRs for failures!  We will likely announce the real branch date on quite short notice, the likely next candidates would be mid may or end of may.  We may need to do extra steps after the branch (like switch some architectures back to old jemalloc on the branch). However, the less difference between -current and the branch, the easier will the release cycle go.  Our goal is to have an unprecedented short release cycle this time. But..  we always say that upfront.   LibreSSL 2.9.1 Released  We have released LibreSSL 2.9.1, which will be arriving in the LibreSSL  directory of your local OpenBSD mirror soon. This is the first stable release  from the 2.9 series, which is also included with OpenBSD 6.5 It includes the following changes and improvements from LibreSSL 2.8.x:   API and Documentation Enhancements  CRYPTO_LOCK is now automatically initialized, with the legacycallbacks stubbed for compatibility. Added the SM3 hash function from the Chinese standard GB/T 32905-2016. Added the SM4 block cipher from the Chinese standard GB/T 32907-2016. Added more OPENSSLNO* macros for compatibility with OpenSSL. Partial port of the OpenSSL ECKEYMETHOD API for use by OpenSSH. Implemented further missing OpenSSL 1.1 API. Added support for XChaCha20 and XChaCha20-Poly1305. Added support for AES key wrap constructions via the EVP interface. Compatibility Changes  Added pbkdf2 key derivation support to openssl(1) enc. Changed the default digest type of openssl(1) enc to sha256. Changed the default digest type of openssl(1) dgst to sha256. Changed the default digest type of openssl(1) x509 -fingerprint to sha256. Changed the default digest type of openssl(1) crl -fingerprint to sha256. Testing and Proactive Security  Added extensive interoperability tests between LibreSSL and OpenSSL1.0 and 1.1. Added additional Wycheproof tests and related bug fixes. Internal Improvements  Simplified sigalgs option processing and handshake signingalgorithm selection. Added the ability to use the RSA PSS algorithm for handshake signatures. Added bnrandinterval() and use it in code needing ranges ofrandom bn values. Added functionality to derive early, handshake, and applicationsecrets as per RFC8446. Added handshake state machine from RFC8446. Removed some ASN.1 related code from libcrypto that had not beenused since around 2000. Unexported internal symbols and internalized more record layer structs. Removed SHA224 based handshake signatures from consideration foruse in a TLS 1.2 handshake. Portable Improvements  Added support for assembly optimizations on 32-bit ARM ELF targets. Added support for assembly optimizations on Mingw-w64 targets. Improved Android compatibility Bug Fixes  Improved protection against timing side channels in ECDSA signaturegeneration. Coordinate blinding was added to some elliptic curves. This is thelast bit of the work by Brumley et al. to protect against the Portsmashvulnerability. Ensure transcript handshake is always freed with TLS 1.2.    The LibreSSL project continues improvement of the codebase to reflect modern,  safe programming practices. We welcome feedback and improvements from the  broader community. Thanks to all of the contributors who helped make this  release possible.  FreeBSD Mastery: Jails – Bail Bond Denied Edition  I had a brilliant, hideous idea: to produce a charity edition of FreeBSD Mastery: Jails featuring the cover art I would use if I was imprisoned and did not have access to a real cover artist. (Never mind that I wouldn’t be permitted to release books while in jail: we creative sorts scoff at mere legal and cultural details.)  I originally wanted to produce my own take on the book’s cover art. My first attempt failed spectacularly.  I downgraded my expectations and tried again. And again. And again.  I’m pleased to reveal the final cover for FreeBSD Mastery: Jails–Bail Bond Edition!  This cover represents the very pinnacle of my artistic talents, and is the result of literally hours of effort.  But, as this book is available only to the winner of charity fund-raisers, purchase of this tome represents moral supremacy. I recommend flaunting it to your family, coworkers, and all those of lesser character.  Get your copy by winning the BSDCan 2019 charity auction… or any other other auction-type event I deem worthwhile.  As far as my moral fiber goes: I have learned that art is hard, and that artists are not paid enough.  And if I am ever imprisoned, I do hope that you’ll contribute to my bail fund. Otherwise, you’ll get more covers like this one.  One reason ed(1) was a good editor back in the days of V7 Unix  It is common to describe ed(1) as being line oriented, as opposed to screen oriented editors like vi. This is completely accurate but it is perhaps not a complete enough description for today, because ed is line oriented in a way that is now uncommon. After all, you could say that your shell is line oriented too, and very few people use shells that work and feel the same way ed does.  The surface difference between most people's shells and ed is that most people's shells have some version of cursor based interactive editing. The deeper difference is that this requires the shell to run in character by character TTY input mode, also called raw mode. By contrast, ed runs in what Unix usually calls cooked mode, where it reads whole lines from the kernel and the kernel handles things like backspace. All of ed's commands are designed so that they work in this line focused way (including being terminated by the end of the line), and as a whole ed's interface makes this whole line input approach natural. In fact I think ed makes it so natural that it's hard to think of things as being any other way. Ed was designed for line at a time input, not just to not be screen oriented.  This input mode difference is not very important today, but in the days of V7 and serial terminals it made a real difference. In cooked mode, V7 ran very little code when you entered each character; almost everything was deferred until it could be processed in bulk by the kernel, and then handed to ed all in a single line which ed could also process all at once. A version of ed that tried to work in raw mode would have been much more resource intensive, even if it still operated on single lines at a time.  Beastie Bits  CFT for FreeBSD ZoL Simple DNS Adblock AT&amp;T Unix PC in 1985 OpenBSD-current drm at 4.19, includes new support for Intel GPUs like Coffee Lake "What are the differences between Linux and OpenBSD?" - Twitter thread Announcing the pkgsrc-2019Q1 release (2019-04-10)   Feedback/Questions  Brad - iocage Frank - Video from Level1Tech and a question Niall - Revision Control    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>OpenBSD 6.5 has been released, mount ZFS datasets anywhere, help test upcoming NetBSD 9 branch, LibreSSL 2.9.1 is available, Bail Bond Denied Edition of FreeBSD Mastery: Jails, and one reason ed(1) was a good editor back in the days in this week’s episode.</p> <h2>Headlines</h2> <h3><a href="https://www.openbsd.org/65.html" rel="nofollow" target="_blank">OpenBSD 6.5 Released</a></h3> <ul> <li><a href="https://www.openbsd.org/plus65.html" rel="nofollow" target="_blank">Changelog</a></li> <li><a href="https://www.openbsd.org/ftp.html" rel="nofollow" target="_blank">Mirrors</a></li> <li>6.5 Includes<br><ul> <li>OpenSMTPD 6.5.0</li> <li>LibreSSL 2.9.1</li> <li>OpenSSH 8.0</li> <li>Mandoc 1.14.5</li> <li>Xenocara</li> <li>LLVM/Clang 7.0.1 (+ patches)</li> <li>GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)</li></ul> </li> <li>Many pre-built packages for each architecture:<br><ul> <li>aarch64: 9654</li> <li>amd64: 10602</li> <li>i386: 10535</li></ul> </li> </ul> <p></p> <h3><a href="https://dan.langille.org/2019/04/22/mount-your-zfs-datasets-anywhere-you-want/" rel="nofollow" target="_blank">Mount your ZFS datasets anywhere you want</a></h3> <blockquote> <p>ZFS is very flexible about mountpoints, and there are many features available to provide great flexibility.<br>  When you create zpool main<em>tank, the default mountpoint is /main</em>tank.<br>  You might be happy with that, but you don’t have to be content. You can do magical things.</p> </blockquote> <ul> <li>Some highlights are:<br><ul> <li>mount point can be inherited</li> <li>not all filesystems in a zpool need to be mounted</li> <li>each filesystem (directory) can have different ZFS characteristics</li> <li>In my case, let’s look at this new zpool I created earlier today and I will show you some very simple alternatives. This zpool use NVMe devices which should be faster than SSDs especially when used with multiple concurrent writes. This is my plan: run all the Bacula regression tests concurrently.</li></ul> </li> </ul> <p></p> <h2>News Roundup</h2> <h3><a href="https://mail-index.netbsd.org/current-users/2019/04/24/msg035645.html" rel="nofollow" target="_blank">Branch for netbsd 9 upcoming, please help and test -current</a></h3> <blockquote> <p>Folks,<br>  once again we are quite late for branching the next NetBSD release (NetBSD 9).<br>  Initially planned to happen early in February 2019, we are now approaching May and it is unlikely that the branch will happen before that.<br>  On the positive side, lots of good things landed in -current in between, like new Mesa, new jemalloc, lots of ZFS improvements - and some of those would be hard to pull up to the branch later.<br>  On the bad side we saw lots of churn in -current recently, and there is quite  some fallout where we not even have a good overview right now. And this is where  you can help:</p> <ul> <li>please test -current, on all the various machines you have</li> <li>especially interesting would be test results from uncommon architectures<br>  or strange combinations (like the sparc userland on sparc64 kernel issue<br>  I ran in yesterday)<br>  Please test, report success, and file PRs for failures!<br>  We will likely announce the real branch date on quite short notice, the likely next candidates would be mid may or end of may.<br>  We may need to do extra steps after the branch (like switch some architectures back to old jemalloc on the branch). However, the less difference between -current and the branch, the easier will the release cycle go.<br>  Our goal is to have an unprecedented short release cycle this time. But..<br>  we always say that upfront.</li> </ul> </blockquote> <h3><a href="https://marc.info/?l=openbsd-announce&amp;m=155590112606279&amp;w=2" rel="nofollow" target="_blank">LibreSSL 2.9.1 Released</a></h3> <blockquote> <p>We have released LibreSSL 2.9.1, which will be arriving in the LibreSSL<br>  directory of your local OpenBSD mirror soon. This is the first stable release<br>  from the 2.9 series, which is also included with OpenBSD 6.5</p> <p>It includes the following changes and improvements from LibreSSL 2.8.x:</p> </blockquote> <ul> <li><p>API and Documentation Enhancements</p> <ul> <li>CRYPTO_LOCK is now automatically initialized, with the legacy<br>callbacks stubbed for compatibility.</li> <li>Added the SM3 hash function from the Chinese standard GB/T 32905-2016.</li> <li>Added the SM4 block cipher from the Chinese standard GB/T 32907-2016.</li> <li>Added more OPENSSL<em>NO</em>* macros for compatibility with OpenSSL.</li> <li>Partial port of the OpenSSL EC<em>KEY</em>METHOD API for use by OpenSSH.</li> <li>Implemented further missing OpenSSL 1.1 API.</li> <li>Added support for XChaCha20 and XChaCha20-Poly1305.</li> <li>Added support for AES key wrap constructions via the EVP interface.</li></ul></li> <li><p>Compatibility Changes</p> <ul> <li>Added pbkdf2 key derivation support to openssl(1) enc.</li> <li>Changed the default digest type of openssl(1) enc to sha256.</li> <li>Changed the default digest type of openssl(1) dgst to sha256.</li> <li>Changed the default digest type of openssl(1) x509 -fingerprint to sha256.</li> <li>Changed the default digest type of openssl(1) crl -fingerprint to sha256.</li></ul></li> <li><p>Testing and Proactive Security</p> <ul> <li>Added extensive interoperability tests between LibreSSL and OpenSSL<br>1.0 and 1.1.</li> <li>Added additional Wycheproof tests and related bug fixes.</li></ul></li> <li><p>Internal Improvements</p> <ul> <li>Simplified sigalgs option processing and handshake signing<br>algorithm selection.</li> <li>Added the ability to use the RSA PSS algorithm for handshake signatures.</li> <li>Added bn<em>rand</em>interval() and use it in code needing ranges of<br>random bn values.</li> <li>Added functionality to derive early, handshake, and application<br>secrets as per RFC8446.</li> <li>Added handshake state machine from RFC8446.</li> <li>Removed some ASN.1 related code from libcrypto that had not been<br>used since around 2000.</li> <li>Unexported internal symbols and internalized more record layer structs.</li> <li>Removed SHA224 based handshake signatures from consideration for<br>use in a TLS 1.2 handshake.</li></ul></li> <li><p>Portable Improvements</p> <ul> <li>Added support for assembly optimizations on 32-bit ARM ELF targets.</li> <li>Added support for assembly optimizations on Mingw-w64 targets.</li> <li>Improved Android compatibility</li></ul></li> <li><p>Bug Fixes</p> <p></p><ul> <li>Improved protection against timing side channels in ECDSA signature<br>generation.</li><p></p> <p></p><li>Coordinate blinding was added to some elliptic curves. This is the<br>last bit of the work by Brumley et al. to protect against the Portsmash<br>vulnerability.</li><p></p> <p></p><li>Ensure transcript handshake is always freed with TLS 1.2.</li></ul> <p></p></li> </ul><p></p> <blockquote> <p>The LibreSSL project continues improvement of the codebase to reflect modern,<br>  safe programming practices. We welcome feedback and improvements from the<br>  broader community. Thanks to all of the contributors who helped make this<br>  release possible.</p> </blockquote> <h3><a href="https://mwl.io/archives/4227" rel="nofollow" target="_blank">FreeBSD Mastery: Jails – Bail Bond Denied Edition</a></h3> <blockquote> <p>I had a brilliant, hideous idea: to produce a charity edition of FreeBSD Mastery: Jails featuring the cover art I would use if I was imprisoned and did not have access to a real cover artist. (Never mind that I wouldn’t be permitted to release books while in jail: we creative sorts scoff at mere legal and cultural details.)<br>  I originally wanted to produce my own take on the book’s cover art. My first attempt failed spectacularly.<br>  I downgraded my expectations and tried again. And again. And again.<br>  I’m pleased to reveal the final cover for FreeBSD Mastery: Jails–Bail Bond Edition!<br>  This cover represents the very pinnacle of my artistic talents, and is the result of literally hours of effort.<br>  But, as this book is available only to the winner of charity fund-raisers, purchase of this tome represents moral supremacy. I recommend flaunting it to your family, coworkers, and all those of lesser character.<br>  Get your copy by winning the BSDCan 2019 charity auction… or any other other auction-type event I deem worthwhile.<br>  As far as my moral fiber goes: I have learned that art is hard, and that artists are not paid enough.<br>  And if I am ever imprisoned, I do hope that you’ll contribute to my bail fund. Otherwise, you’ll get more covers like this one.</p> </blockquote> <h3><a href="https://utcc.utoronto.ca/~cks/space/blog/unix/EdDesignedForCookedInput" rel="nofollow" target="_blank">One reason ed(1) was a good editor back in the days of V7 Unix</a></h3> <blockquote> <p>It is common to describe ed(1) as being line oriented, as opposed to screen oriented editors like vi. This is completely accurate but it is perhaps not a complete enough description for today, because ed is line oriented in a way that is now uncommon. After all, you could say that your shell is line oriented too, and very few people use shells that work and feel the same way ed does.<br>  The surface difference between most people's shells and ed is that most people's shells have some version of cursor based interactive editing. The deeper difference is that this requires the shell to run in character by character TTY input mode, also called raw mode. By contrast, ed runs in what Unix usually calls cooked mode, where it reads whole lines from the kernel and the kernel handles things like backspace. All of ed's commands are designed so that they work in this line focused way (including being terminated by the end of the line), and as a whole ed's interface makes this whole line input approach natural. In fact I think ed makes it so natural that it's hard to think of things as being any other way. Ed was designed for line at a time input, not just to not be screen oriented.<br>  This input mode difference is not very important today, but in the days of V7 and serial terminals it made a real difference. In cooked mode, V7 ran very little code when you entered each character; almost everything was deferred until it could be processed in bulk by the kernel, and then handed to ed all in a single line which ed could also process all at once. A version of ed that tried to work in raw mode would have been much more resource intensive, even if it still operated on single lines at a time.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://lists.freebsd.org/pipermail/freebsd-fs/2019-April/027603.html" rel="nofollow" target="_blank">CFT for FreeBSD ZoL</a></li> <li><a href="https://github.com/wilyarti/simple-dns-adblock" rel="nofollow" target="_blank">Simple DNS Adblock</a></li> <li><a href="https://twitter.com/unix_byte/status/1119904828182781958" rel="nofollow" target="_blank">AT&amp;T Unix PC in 1985</a></li> <li><a href="https://marc.info/?l=openbsd-cvs&amp;m=155523690813457&amp;w=2" rel="nofollow" target="_blank">OpenBSD-current drm at 4.19, includes new support for Intel GPUs like Coffee Lake</a></li> <li><a href="https://twitter.com/cfenollosa/status/1122069042083323904" rel="nofollow" target="_blank">"What are the differences between Linux and OpenBSD?" - Twitter thread</a></li> <li><a href="http://mail-index.netbsd.org/pkgsrc-users/2019/04/10/msg028308.html" rel="nofollow" target="_blank">Announcing the pkgsrc-2019Q1 release (2019-04-10)</a></li> </ul> <p></p> <h2>Feedback/Questions</h2> <ul> <li>Brad - <a href="http://dpaste.com/0K2QFTM#wrap" rel="nofollow" target="_blank">iocage</a></li> <li>Frank - <a href="http://dpaste.com/3110R96#wrap" rel="nofollow" target="_blank">Video from Level1Tech and a question</a></li> <li>Niall - <a href="http://dpaste.com/0A32XDK#wrap" rel="nofollow" target="_blank">Revision Control</a></li> </ul> <p></p> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li> </ul> <p></p>    <br>    Your browser does not support the HTML5 video tag.

296: It’s Alive: OpenBSD 6.5

OPNsense 19.7.1 is out, ZFS on Linux still has annoying issues with ARC size, Hammer2 is now default, NetBSD audio – an application perspective, new FreeNAS Mini, and more.  Headlines OPNsense 19.7.1  We do not wish to keep you from enjoying your summer time, but this is a recommended security update enriched with reliability fixes for the new 19.7 series.  Of special note are performance improvements as well as a fix for a longstanding NAT before IPsec limitation. Full patch notes:   system: do not create automatic copies of existing gateways system: do not translate empty tunables descriptions system: remove unwanted form action tags system: do not include Syslog-ng in rc.freebsd handler system: fix manual system log stop/start/restart system: scoped IPv6 "%" could confuse mwexecf(), use plain mwexec() instead system: allow curl-based downloads to use both trusted and local authorities system: fix group privilege print and correctly redirect after edit system: use cached address list in referrer check system: fix Syslog-ng search stats firewall: HTML-escape dynamic entries to display aliases firewall: display correct IP version in automatic rules firewall: fix a warning while reading empty outbound rules configuration firewall: skip illegal log lines in live log interfaces: performance improvements for configurations with hundreds of interfaces reporting: performance improvements for Python 3 NetFlow aggregator rewrite dhcp: move advanced router advertisement options to correct config section ipsec: replace global array access with function to ensure side-effect free boot ipsec: change DPD action on start to "dpdaction = restart" ipsec: remove already default "dpdaction = none" if not set ipsec: use interface IP address in local ID when doing NAT before IPsec web proxy: fix database reset for Squid 4 by replacing use of ssl_crtd with security_file_certgen plugins: os-acme-client 1.24[1] plugins: os-bind 1.6[2] plugins: os-dnscrypt-proxy 1.5[3] plugins: os-frr now restricts characters BGP prefix-list and route-maps[4] plugins: os-google-cloud-sdk 1.0[5] ports: curl 7.65.3[6] ports: monit 5.26.0[7] ports: openssh 8.0p1[8] ports: php 7.2.20[9] ports: python 3.7.4[10] ports: sqlite 3.29.0[11] ports: squid 4.8[12]   Stay safe and hydrated, Your OPNsense team  ZFS on Linux still has annoying issues with ARC size One of the frustrating things about operating ZFS on Linux is that the ARC size is critical but ZFS's auto-tuning of it is opaque and apparently prone to malfunctions, where your ARC will mysteriously shrink drastically and then stick there.  Linux's regular filesystem disk cache is very predictable; if you do disk IO, the cache will relentlessly grow to use all of your free memory. This sometimes disconcerts people when free reports that there's very little memory actually free, but at least you're getting value from your RAM. This is so reliable and regular that we generally don't think about 'is my system going to use all of my RAM as a disk cache', because the answer is always 'yes'. (The general filesystem cache is also called the page cache.) This is unfortunately not the case with the ZFS ARC in ZFS on Linux (and it wasn't necessarily the case even on Solaris). ZFS has both a current size and a 'target size' for the ARC (called 'c' in ZFS statistics). When your system boots this target size starts out as the maximum allowed size for the ARC, but various events afterward can cause it to be reduced (which obviously limits the size of your ARC, since that's its purpose). In practice, this reduction in the target size is both pretty sticky and rather mysterious (as ZFS on Linux doesn't currently expose enough statistics to tell why your ARC target size shrunk in any particular case). The net effect is that the ZFS ARC is not infrequently quite shy and hesitant about using memory, in stark contrast to Linux's normal filesystem cache. The default maximum ARC size starts out as only half of your RAM (unlike the regular filesystem cache, which will use all of it), and then it shrinks from there, sometimes very significantly, and once shrunk it only recovers slowly (if at all).  News Roundup Hammer2 is now default commit a49112761c919d42d405ec10252eb0553662c824 Author: Matthew Dillon  Date:   Mon Jun 10 17:53:46 2019 -0700      installer - Default to HAMMER2      * Change the installer default from HAMMER1 to HAMMER2.      * Adjust the nrelease build to print the location of the image files       when it finishes.  Summary of changes:  nrelease/Makefile                          |  2 +-  usr.sbin/installer/dfuibe_installer/flow.c | 20 ++++++++++----------  2 files changed, 11 insertions(+), 11 deletions(-)  http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a49112761c919d42d405ec10252eb0553662c824  NetBSD audio – an application perspective  NetBSD audio – an application perspective ... or, "doing it natively, because we can"   audio options for NetBSD in pkgsrc  Use NetBSD native audio (sun audio/audioio.h) Or OSS emulation layer: Basically a wrapper around sun audio in the kernel. Incomplete and old version, but works for simple stuff  Many many abstraction layers available:  OpenAL-Soft alsa-lib (config file required) libao, GStreamer (plugins!) PortAudio, SDL PulseAudio, JACK ... lots more!? some obsolete stuff (esd, nas?)  Advantages of using NetBSD audio directly  Low latency, low CPU usage: Abstraction layers differ in latency (SDL2 vs ALSA/OpenAL) Query device information: Is /dev/audio1 a USB microphone or another sound card? Avoid bugs from excessive layering Nice API, well documented: [nia note: I had no idea how to write audio code. I read a man page and now I do.] Your code might work on illumos too  [nia note: SDL2 seems very sensitive to the blk_ms sysctl being high or low, with other implementations there seems to be a less noticable difference. I don't know why.]  New FreeNAS Mini  Two new FreeNAS Mini systems join the very popular FreeNAS Mini and Mini XL: FreeNAS Mini XL+: This powerful 10 Bay platform (8x 3.5” and 1x 2.5” hot-swap, 1x 2.5” internal) includes the latest, compact server technology and provides dual 10GbE ports, 8 CPU cores and 32 GB RAM for high performance workgroups. The Mini XL+ scales beyond 100TB and is ideal for very demanding applications, including hosting virtual machines and multimedia editing. Starting at $1499, the Mini XL+ configured with cache SSD and 80 TB capacity is $4299, and consumes about 100 Watts. FreeNAS Mini E: This cost-effective 4 Bay platform provides the resources required for SOHO use with quad GbE ports and 8 GB of RAM. The Mini E is ideal for file sharing, streaming and transcoding video at 1080p. Starting at $749, the Mini E configured with 8 TB capacity is $999, and consumes about 36 Watts.  Beastie Bits  Welcome to NetBSD 9.99.1! Berkeley smorgasbord — part II dtracing postgres Project Trident 19.07-U1 now available Need a Secure Operating System? Take a Look at OpenBSD  Feedback/Questions  Jeff - OpenZFS Port Testing Feedback Malcolm - Best Practices for Custom Ports Michael - Little Correction   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv               Your browser does not support the HTML5 video tag.

<p>OPNsense 19.7.1 is out, ZFS on Linux still has annoying issues with ARC size, Hammer2 is now default, NetBSD audio – an application perspective, new FreeNAS Mini, and more. </p> <h2>Headlines</h2> <h3><a href="https://opnsense.org/opnsense-19-7-1-released/" rel="nofollow" target="_blank">OPNsense 19.7.1</a></h3> <blockquote> <p>We do not wish to keep you from enjoying your summer time, but this<br/> is a recommended security update enriched with reliability fixes for the<br/> new 19.7 series.  Of special note are performance improvements as well<br/> as a fix for a longstanding NAT before IPsec limitation.</p> <p>Full patch notes:</p> </blockquote> <ul> <li>system: do not create automatic copies of existing gateways</li> <li>system: do not translate empty tunables descriptions</li> <li>system: remove unwanted form action tags</li> <li>system: do not include Syslog-ng in rc.freebsd handler</li> <li>system: fix manual system log stop/start/restart</li> <li>system: scoped IPv6 "%" could confuse mwexecf(), use plain mwexec() instead</li> <li>system: allow curl-based downloads to use both trusted and local authorities</li> <li>system: fix group privilege print and correctly redirect after edit</li> <li>system: use cached address list in referrer check</li> <li>system: fix Syslog-ng search stats</li> <li>firewall: HTML-escape dynamic entries to display aliases</li> <li>firewall: display correct IP version in automatic rules</li> <li>firewall: fix a warning while reading empty outbound rules configuration</li> <li>firewall: skip illegal log lines in live log</li> <li>interfaces: performance improvements for configurations with hundreds of interfaces</li> <li>reporting: performance improvements for Python 3 NetFlow aggregator rewrite</li> <li>dhcp: move advanced router advertisement options to correct config section</li> <li>ipsec: replace global array access with function to ensure side-effect free boot</li> <li>ipsec: change DPD action on start to "dpdaction = restart"</li> <li>ipsec: remove already default "dpdaction = none" if not set</li> <li>ipsec: use interface IP address in local ID when doing NAT before IPsec</li> <li>web proxy: fix database reset for Squid 4 by replacing use of ssl_crtd with security_file_certgen</li> <li>plugins: os-acme-client 1.24[1]</li> <li>plugins: os-bind 1.6[2]</li> <li>plugins: os-dnscrypt-proxy 1.5[3]</li> <li>plugins: os-frr now restricts characters BGP prefix-list and route-maps[4]</li> <li>plugins: os-google-cloud-sdk 1.0[5]</li> <li>ports: curl 7.65.3[6]</li> <li>ports: monit 5.26.0[7]</li> <li>ports: openssh 8.0p1[8]</li> <li>ports: php 7.2.20[9]</li> <li>ports: python 3.7.4[10]</li> <li>ports: sqlite 3.29.0[11]</li> <li>ports: squid 4.8[12]</li> </ul> <blockquote> <p>Stay safe and hydrated, Your OPNsense team</p> </blockquote> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/ZFSOnLinuxARCShrinkage" rel="nofollow" target="_blank">ZFS on Linux still has annoying issues with ARC size</a></h3> <p><code>One of the frustrating things about operating ZFS on Linux is that the ARC size is critical but ZFS's auto-tuning of it is opaque and apparently prone to malfunctions, where your ARC will mysteriously shrink drastically and then stick there.</code></p> <blockquote> <p>Linux's regular filesystem disk cache is very predictable; if you do disk IO, the cache will relentlessly grow to use all of your free memory. This sometimes disconcerts people when free reports that there's very little memory actually free, but at least you're getting value from your RAM. This is so reliable and regular that we generally don't think about 'is my system going to use all of my RAM as a disk cache', because the answer is always 'yes'. (The general filesystem cache is also called the page cache.)</p> <p>This is unfortunately not the case with the ZFS ARC in ZFS on Linux (and it wasn't necessarily the case even on Solaris). ZFS has both a current size and a 'target size' for the ARC (called 'c' in ZFS statistics). When your system boots this target size starts out as the maximum allowed size for the ARC, but various events afterward can cause it to be reduced (which obviously limits the size of your ARC, since that's its purpose). In practice, this reduction in the target size is both pretty sticky and rather mysterious (as ZFS on Linux doesn't currently expose enough statistics to tell why your ARC target size shrunk in any particular case).</p> <p>The net effect is that the ZFS ARC is not infrequently quite shy and hesitant about using memory, in stark contrast to Linux's normal filesystem cache. The default maximum ARC size starts out as only half of your RAM (unlike the regular filesystem cache, which will use all of it), and then it shrinks from there, sometimes very significantly, and once shrunk it only recovers slowly (if at all).</p> </blockquote> <h2>News Roundup</h2> <h3><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-June/718989.html" rel="nofollow" target="_blank">Hammer2 is now default</a></h3> <code>commit a49112761c919d42d405ec10252eb0553662c824 Author: Matthew Dillon  Date:   Mon Jun 10 17:53:46 2019 -0700      installer - Default to HAMMER2      * Change the installer default from HAMMER1 to HAMMER2.      * Adjust the nrelease build to print the location of the image files       when it finishes.  Summary of changes:  nrelease/Makefile                          |  2 +-  usr.sbin/installer/dfuibe_installer/flow.c | 20 ++++++++++----------  2 files changed, 11 insertions(+), 11 deletions(-)  <a href="http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a49112761c919d42d405ec10252eb0553662c824" rel="nofollow" target="_blank">http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/a49112761c919d42d405ec10252eb0553662c824</a> </code> <h3><a href="https://netbsd.org/gallery/presentations/nia/netbsd-audio/" rel="nofollow" target="_blank">NetBSD audio – an application perspective</a></h3> <blockquote> <p>NetBSD audio – an application perspective ... or, "doing it natively, because we can"</p> </blockquote> <ul> <li><p>audio options for NetBSD in pkgsrc</p> <ul> <li>Use NetBSD native audio (sun audio/audioio.h)</li> <li>Or OSS emulation layer: Basically a wrapper around sun audio in the kernel. Incomplete and old version, but works for simple stuff</li> </ul></li> <li><p>Many many abstraction layers available:</p> <ul> <li>OpenAL-Soft</li> <li>alsa-lib (config file required)</li> <li>libao, GStreamer (plugins!)</li> <li>PortAudio, SDL</li> <li>PulseAudio, JACK</li> <li>... lots more!? some obsolete stuff (esd, nas?)</li> </ul></li> <li><p>Advantages of using NetBSD audio directly</p> <ul> <li>Low latency, low CPU usage: Abstraction layers differ in latency (SDL2 vs ALSA/OpenAL)</li> <li>Query device information: Is /dev/audio1 a USB microphone or another sound card?</li> <li>Avoid bugs from excessive layering</li> <li>Nice API, well documented: [nia note: I had no idea how to write audio code. I read a man page and now I do.]</li> <li>Your code might work on illumos too</li> </ul></li> <li><p>[nia note: SDL2 seems very sensitive to the blk_ms sysctl being high or low, with other implementations there seems to be a less noticable difference. I don't know why.]</p></li> </ul> <h3><a href="https://www.ixsystems.com/blog/new-freenas-mini-models-release-pr/" rel="nofollow" target="_blank">New FreeNAS Mini</a></h3> <blockquote> <p>Two new FreeNAS Mini systems join the very popular FreeNAS Mini and Mini XL:</p> <p>FreeNAS Mini XL+: This powerful 10 Bay platform (8x 3.5” and 1x 2.5” hot-swap, 1x 2.5” internal) includes the latest, compact server technology and provides dual 10GbE ports, 8 CPU cores and 32 GB RAM for high performance workgroups. The Mini XL+ scales beyond 100TB and is ideal for very demanding applications, including hosting virtual machines and multimedia editing. Starting at $1499, the Mini XL+ configured with cache SSD and 80 TB capacity is $4299, and consumes about 100 Watts.</p> <p>FreeNAS Mini E: This cost-effective 4 Bay platform provides the resources required for SOHO use with quad GbE ports and 8 GB of RAM. The Mini E is ideal for file sharing, streaming and transcoding video at 1080p. Starting at $749, the Mini E configured with 8 TB capacity is $999, and consumes about 36 Watts.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://mail-index.netbsd.org/source-changes/2019/07/30/msg107671.html" rel="nofollow" target="_blank">Welcome to NetBSD 9.99.1!</a></li> <li><a href="http://blog.snailtext.com/posts/berkeley-smorgasbord-part-2.html" rel="nofollow" target="_blank">Berkeley smorgasbord — part II</a></li> <li><a href="https://www.youtube.com/watch?v=Brt41xnMZqo&amp;list=PLuJmmKtsV1dOTmlImlD9U5j1P1rLxS2V8&amp;index=20&amp;t=0s" rel="nofollow" target="_blank">dtracing postgres</a></li> <li><a href="https://project-trident.org/post/2019-07-30_19.07-u1_available/" rel="nofollow" target="_blank">Project Trident 19.07-U1 now available</a></li> <li><a href="https://www.devprojournal.com/technology-trends/operating-systems/need-a-secure-operating-system-take-a-look-at-openbsd/" rel="nofollow" target="_blank">Need a Secure Operating System? Take a Look at OpenBSD</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Jeff - <a href="http://dpaste.com/2AT7JGP#wrap" rel="nofollow" target="_blank">OpenZFS Port Testing Feedback</a></li> <li>Malcolm - <a href="http://dpaste.com/1R170D7" rel="nofollow" target="_blank">Best Practices for Custom Ports</a></li> <li>Michael - <a href="http://dpaste.com/0CERP6R" rel="nofollow" target="_blank">Little Correction</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li> </ul>              Your browser does not support the HTML5 video tag.

310: My New Free NAS

We have a long interview with fiction and non-fiction author Michael W. Lucas for you this week as well as questions from the audience. ##Headlines ##Interview - Michael W. Lucas - mwlucas@michaelwlucas.com / @mwlauthor  BR: [Welcome Back] AJ: What have you been doing since last we talked to you [ed, ssh, and af3e] BR: Tell us more about AF3e AJ: How did the first Absolute FreeBSD come about? BR: Do you have anything special planned for MeetBSD? AJ: What are you working on now? [FM:Jails, Git sync Murder] BR: What are your plans for next year? AJ: How has SEMIBug been going?  Auction at https://mwl.io Patreon Link:  ##Feedback/Questions  Paul - Recent bhyve related videos (daemon) Michael - freebsd-update question Sigflup - pkg file search    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv 

<p>We have a long interview with fiction and non-fiction author Michael W. Lucas for you this week as well as questions from the audience.</p> <p>##Headlines<br/> ##Interview - Michael W. Lucas - <a href="mailto:mwlucas@michaelwlucas.com">mwlucas@michaelwlucas.com</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow" target="_blank">@mwlauthor</a></p> <ul> <li>BR: [Welcome Back]</li> <li>AJ: What have you been doing since last we talked to you [ed, ssh, and af3e]</li> <li>BR: Tell us more about AF3e</li> <li>AJ: How did the first Absolute FreeBSD come about?</li> <li>BR: Do you have anything special planned for MeetBSD?</li> <li>AJ: What are you working on now? [FM:Jails, Git sync Murder]</li> <li>BR: What are your plans for next year?</li> <li>AJ: How has SEMIBug been going?</li> </ul> <p>Auction at <a href="https://mwl.io" rel="nofollow" target="_blank">https://mwl.io</a><br/> Patreon Link:</p> <p></p> <p>##Feedback/Questions</p> <ul> <li>Paul - <a href="http://dpaste.com/0Q6C25T#wrap" rel="nofollow" target="_blank">Recent bhyve related videos (daemon)</a></li> <li>Michael - <a href="http://dpaste.com/1YTR9FZ" rel="nofollow" target="_blank">freebsd-update question</a></li> <li>Sigflup - <a href="http://dpaste.com/3799BBX#wrap" rel="nofollow" target="_blank">pkg file search</a></li> </ul> <p></p> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li> </ul>

Episode 267: Absolute FreeBSD | BSD Now 267

OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more. Headlines OpenBSD on the Thinkpad X1 Carbon 7th Gen  Another year, another ThinkPad X1 Carbon, this time with a Dolby Atmos sound system and a smaller battery. The seventh generation X1 Carbon isn't much different than the fifth and sixth generations. I opted for the non-vPro Core i5-8265U, 16Gb of RAM, a 512Gb NVMe SSD, and a matte non-touch WQHD display at ~300 nits. A brighter 500-nit 4k display is available, though early reports indicated it severely impacts battery life. Gone are the microSD card slot on the back and 1mm of overall thickness (from 15.95mm to 14.95mm), but also 6Whr of battery (down to 51Whr) and a little bit of travel in the keyboard and TrackPoint buttons. I still very much like the feel of both of them, so kudos to Lenovo for not going too far down the Apple route of sacrificing performance and usability just for a thinner profile. On my fifth generation X1 Carbon, I used a vinyl plotter to cut out stickers to cover the webcam, "X1 Carbon" branding from the bottom of the display, the power button LED, and the "ThinkPad" branding from the lower part of the keyboard deck.   See link for the rest of the article  How To Install FreeBSD On A MacBook 1,1 or 2,1   FreeBSD Setup For MacBook 1,1 and 2,1   FreeBSD with some additional setup can be installed on a MacBook 1,1 or 2,1. This article covers how to do so with FreeBSD 10-12.   Installing   FreeBSD can be installed as the only OS on your MacBook if desired. What you should have is:   A Mac OS X 10.4.6-10.7.5 installer. Unofficial versions modified for these MacBooks such as 10.8 also work. A blank CD or DVD to burn the FreeBSD image to. Discs simply work best with these older MacBooks. An ISO file of FreeBSD for x86. The AMD64 ISO does not boot due to the 32 bit EFI of these MacBooks. Burn the ISO file to the blank CD or DVD. Once done, make sure it's in your MacBook and then power off the MacBook. Turn it on, and hold down the c key until the FreeBSD disc boots.  See link for the rest of the guide   News Roundup Patch for review: Kernel portion of in-kernel TLS (KTLS)  One of the projects I have been working on for the past several months in conjunction with several other folks is upstreaming work from Netflix to handle some aspects of Transport Layer Security (TLS) in the kernel. In particular, this lets a web server use sendfile() to send static content on HTTPS connections.  There is a lot more detail in the review itself, so I will spare pasting a big wall of text here.  However, I have posted the patch to add the kernel-side of KTLS for review at the URL below.  KTLS also requires other patches to OpenSSL and nginx, but this review is only for the kernel bits.  Patches and reviews for the other bits will follow later.   https://reviews.freebsd.org/D21277  DragonFly Boot Enviroments  This is a tool inspired by the beadm utility for FreeBSD/Illumos systems that creates and manages ZFS boot environments. This utility in contrast is written from the ground up in C, this should provide better performance, integration, and extensibility than the POSIX sh and awk script it was inspired by. During the time this project has been worked on, beadm has been superseded by bectl on FreeBSD. After hammering out some of the outstanding internal logic issues, I might look at providing a similar interface to the command as bectl.   See link for the rest of the details  Project Trident Updates  19.08 Available   This is a general package update to the CURRENT release repository based upon TrueOS 19.08. Legacy boot ISO functional again This update includes the FreeBSD fixes for the “vesa” graphics driver for legacy-boot systems. The system can once again be installed on legacy-boot systems.   PACKAGE CHANGES FROM 19.07-U1  New Packages: 154 Deleted Packages: 394 Updated Packages: 4926  12-U3 Available   This is the third general package update to the STABLE release repository based upon TrueOS 12-Stable.   PACKAGE CHANGES FROM STABLE 12-U2   New Packages: 105 Deleted Packages: 386 Updated Packages: 1046   vBSDcon  vBSDcon 2019 will return to the Hyatt Regency in Reston, VA on September 5-7 2019. ***  Beastie Bits  The next NYCBUG meeting will be Sept 4 @ 18:45  Feedback/Questions  Tom - Questions Michael - dfbeadm Bostjan - Questions   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv               Your browser does not support the HTML5 video tag.

<p>OpenBSD on 7th gen Thinkpad X1 Carbon, how to install FreeBSD on a MacBook, Kernel portion of in-kernel TLS (KTLS), Boot Environments on DragonflyBSD, Project Trident Updates, vBSDcon schedule, and more.</p> <h2>Headlines</h2> <h3><a href="https://jcs.org/2019/08/14/x1c7" rel="nofollow" target="_blank">OpenBSD on the Thinkpad X1 Carbon 7th Gen</a></h3> <blockquote> <p>Another year, another ThinkPad X1 Carbon, this time with a Dolby Atmos sound system and a smaller battery.<br/> The seventh generation X1 Carbon isn't much different than the fifth and sixth generations. I opted for the non-vPro Core i5-8265U, 16Gb of RAM, a 512Gb NVMe SSD, and a matte non-touch WQHD display at ~300 nits. A brighter 500-nit 4k display is available, though early reports indicated it severely impacts battery life.<br/> Gone are the microSD card slot on the back and 1mm of overall thickness (from 15.95mm to 14.95mm), but also 6Whr of battery (down to 51Whr) and a little bit of travel in the keyboard and TrackPoint buttons. I still very much like the feel of both of them, so kudos to Lenovo for not going too far down the Apple route of sacrificing performance and usability just for a thinner profile.<br/> On my fifth generation X1 Carbon, I used a vinyl plotter to cut out stickers to cover the webcam, "X1 Carbon" branding from the bottom of the display, the power button LED, and the "ThinkPad" branding from the lower part of the keyboard deck.</p> </blockquote> <ul> <li>See link for the rest of the article</li> </ul> <h3><a href="http://lexploit.com/freebsdmacbook1-1-2-1/" rel="nofollow" target="_blank">How To Install FreeBSD On A MacBook 1,1 or 2,1</a></h3> <ul> <li> FreeBSD Setup For MacBook 1,1 and 2,1</li> </ul> <blockquote> <p>FreeBSD with some additional setup can be installed on a MacBook 1,1 or 2,1. This article covers how to do so with FreeBSD 10-12.</p> </blockquote> <ul> <li>Installing</li> </ul> <blockquote> <p>FreeBSD can be installed as the only OS on your MacBook if desired. What you should have is:</p> </blockquote> <ul> <li>A Mac OS X 10.4.6-10.7.5 installer. Unofficial versions modified for these MacBooks such as 10.8 also work.</li> <li>A blank CD or DVD to burn the FreeBSD image to. Discs simply work best with these older MacBooks.</li> <li>An ISO file of FreeBSD for x86. The AMD64 ISO does not boot due to the 32 bit EFI of these MacBooks.</li> <li><p>Burn the ISO file to the blank CD or DVD. Once done, make sure it's in your MacBook and then power off the MacBook. Turn it on, and hold down the c key until the FreeBSD disc boots.</p> <ul> <li>See link for the rest of the guide</li> </ul></li> </ul> <h2>News Roundup</h2> <h3><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=351522" rel="nofollow" target="_blank">Patch for review: Kernel portion of in-kernel TLS (KTLS)</a></h3> <blockquote> <p>One of the projects I have been working on for the past several months in conjunction with several other folks is upstreaming work from Netflix to handle some aspects of Transport Layer Security (TLS) in the kernel. In particular, this lets a web server use sendfile() to send static content on HTTPS connections.  There is a lot more detail in the review itself, so I will spare pasting a big wall of text here.  However, I have posted the patch to add the kernel-side of KTLS for review at the URL below.  KTLS also requires other patches to OpenSSL and nginx, but this review is only for the kernel bits.  Patches and reviews for the other bits will follow later.</p> </blockquote> <ul> <li><a href="https://reviews.freebsd.org/D21277" rel="nofollow" target="_blank">https://reviews.freebsd.org/D21277</a></li> </ul> <h3><a href="https://github.com/newnix/dfbeadm" rel="nofollow" target="_blank">DragonFly Boot Enviroments</a></h3> <blockquote> <p>This is a tool inspired by the beadm utility for FreeBSD/Illumos systems that creates and manages ZFS boot environments. This utility in contrast is written from the ground up in C, this should provide better performance, integration, and extensibility than the POSIX sh and awk script it was inspired by. During the time this project has been worked on, beadm has been superseded by bectl on FreeBSD. After hammering out some of the outstanding internal logic issues, I might look at providing a similar interface to the command as bectl.</p> </blockquote> <ul> <li>See link for the rest of the details</li> </ul> <h3>Project Trident Updates</h3> <ul> <li><a href="https://project-trident.org/post/2019-08-15_19.08_available/" rel="nofollow" target="_blank">19.08 Available</a></li> </ul> <blockquote> <p>This is a general package update to the CURRENT release repository based upon TrueOS 19.08.<br/> Legacy boot ISO functional again<br/> This update includes the FreeBSD fixes for the “vesa” graphics driver for legacy-boot systems. The system can once again be installed on legacy-boot systems.</p> </blockquote> <ul> <li><p>PACKAGE CHANGES FROM 19.07-U1</p> <ul> <li>New Packages: 154</li> <li>Deleted Packages: 394</li> <li>Updated Packages: 4926</li> </ul></li> <li><p><a href="https://project-trident.org/post/2019-08-22_stable12-u3_available/" rel="nofollow" target="_blank">12-U3 Available</a></p></li> </ul> <blockquote> <p>This is the third general package update to the STABLE release repository based upon TrueOS 12-Stable.</p> </blockquote> <ul> <li>PACKAGE CHANGES FROM STABLE 12-U2  <ul> <li>New Packages: 105</li> <li>Deleted Packages: 386</li> <li>Updated Packages: 1046</li> </ul></li> </ul> <h3><a href="https://www.vbsdcon.com/schedule/" rel="nofollow" target="_blank">vBSDcon</a></h3> <ul> <li>vBSDcon 2019 will return to the Hyatt Regency in Reston, VA on September 5-7 2019. ***</li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.nycbug.org/index?action=view&amp;id=10671" rel="nofollow" target="_blank">The next NYCBUG meeting will be Sept 4 @ 18:45</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Tom - <a href="http://dpaste.com/1AXXK7G#wrap" rel="nofollow" target="_blank">Questions</a></li> <li>Michael - <a href="http://dpaste.com/0PNEDYT#wrap" rel="nofollow" target="_blank">dfbeadm</a></li> <li>Bostjan - <a href="http://dpaste.com/1N7T7BR#wrap" rel="nofollow" target="_blank">Questions</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li> </ul>              Your browser does not support the HTML5 video tag.

313: In-Kernel TLS

Unix is 50, Hunting down Ken's PDP-7, OpenBSD and OPNSense have new releases, Clarification on what GhostBSD is, sshuttle  - VPN over SSH, and more. Headlines Unix is 50  In the summer of 1969 computer scientists Ken Thompson and Dennis Ritchie created the first implementation of Unix with the goal of designing an elegant and economical operating system for a little-used PDP-7 minicomputer at Bell Labs. That modest project, however, would have a far-reaching legacy. Unix made large-scale networking of diverse computing systems — and the Internet — practical. The Unix team went on to develop the C language, which brought an unprecedented combination of efficiency and expressiveness to programming. Both made computing more "portable". Today, Linux, the most popular descendent of Unix, powers the vast majority of servers, and elements of Unix and Linux are found in most mobile devices. Meanwhile C++ remains one of the most widely used programming languages today. Unix may be a half-century old but its influence is only growing.  Hunting down Ken's PDP-7: video footage found  In my prior blog post, I traced Ken's scrounged PDP-7 to SN 34. In this post I'll show that we have actual video footage of that PDP-7 due to an old film from Bell Labs. this gives us almost a minute of footage of the PDP-7 Ken later used to create Unix.  News Roundup OpenBSD 6.6 Released  Announce: https://marc.info/?l=openbsd-tech&amp;m=157132024225971&amp;w=2 Upgrade Guide: https://openbsd.org/faq/upgrade66.html Changelog: https://openbsd.org/plus66.html  OPNsense 19.7.5 released  Hello friends and followers, Lots of plugin and ports updates this time with a few minor improvements in all core areas. Behind the scenes we are starting to migrate the base system to version  12.1 which is supposed to hit the next 20.1 release.  Stay tuned for more infos in the next month or so. Here are the full patch notes:  system: show all swap partitions in system information widget system: flatten services_get() in preparation for removal system: pin Syslog-ng version to specific package name system: fix LDAP/StartTLS with user import page system: fix a PHP warning on authentication server page system: replace most subprocess.call use interfaces: fix devd handling of carp devices (contributed by stumbaumr) firewall: improve firewall rules inline toggles firewall: only allow TCP flags on TCP protocol firewall: simplify help text for direction setting firewall: make protocol log summary case insensitive reporting: ignore malformed flow records captive portal: fix type mismatch for timeout read dhcp: add note for static lease limitation with lease registration (contributed by Northguy) ipsec: add margintime and rekeyfuzz options ipsec: clear $dpdline correctly if not set ui: fix tokenizer reorder on multiple saves plugins: os-acme-client 1.26[1] plugins: os-bind will reload bind on record change (contributed by blablup) plugins: os-etpro-telemetry minor subprocess.call replacement plugins: os-freeradius 1.9.4[2] plugins: os-frr 1.12[3] plugins: os-haproxy 2.19[4] plugins: os-mailtrail 1.2[5] plugins: os-postfix 1.11[6] plugins: os-rspamd 1.8[7] plugins: os-sunnyvalley LibreSSL support (contributed by Sunny Valley Networks) plugins: os-telegraf 1.7.6[8] plugins: os-theme-cicada 1.21 (contributed by Team Rebellion) plugins: os-theme-tukan 1.21 (contributed by Team Rebellion) plugins: os-tinc minor subprocess.call replacement plugins: os-tor 1.8 adds dormant mode disable option (contributed by Fabian Franz) plugins: os-virtualbox 1.0 (contributed by andrewhotlab)  Dealing with the misunderstandings of what is GhostBSD  Since the release of 19.09, I have seen a lot of misunderstandings on what is GhostBSD and the future of GhostBSD. GhostBSD is based on TrueOS with FreeBSD 12 STABLE with our twist to it. We are still continuing to use TrueOS for OpenRC, and the new package's system for the base system that is built from ports. GhostBSD is becoming a slow-moving rolling release base on the latest TrueOS with FreeBSD 12 STABLE. When FreeBSD 13 STABLE gets released, GhostBSD will be upgraded to TrueOS with FreeBSD 13 STABLE. Our official desktop is MATE, which means that the leading developer of GhostBSD does not officially support XFCE. Community releases are maintained by the community and for the community. GhostBSD project will provide help to build and to host the community release. If anyone wants to have a particular desktop supported, it is up to the community. Sure I will help where I can, answer questions and guide new community members that contribute to community release. There is some effort going on for Plasma5 desktop. If anyone is interested in helping with XFCE and Plasma5 or in creating another community release, you are well come to contribute. Also, Contribution to the GhostBSD base system, to ports and new ports, and in house software are welcome. We are mostly active on Telegram https://t.me/ghostbsd, but you can also reach us on the forum.  SHUTTLE – VPN over SSH | VPN Alternative  Looking for a lightweight VPN client, but are not ready to spend a monthly recurring amount on a VPN? VPNs can be expensive depending upon the quality of service and amount of privacy you want. A good VPN plan can easily set you back by 10$ a month and even that doesn’t guarantee your privacy. There is no way to be sure whether the VPN is storing your confidential information and traffic logs or not. sshuttle is the answer to your problem it provides VPN over ssh and in this article we’re going to explore this cheap yet powerful alternative to the expensive VPNs. By using open source tools you can control your own privacy.   VPN over SSH – sshuttle   sshuttle is an awesome program that allows you to create a VPN connection from your local machine to any remote server that you have ssh access on. The tunnel established over the ssh connection can then be used to route all your traffic from client machine through the remote machine including all the dns traffic. In the bare bones sshuttle is just a proxy server which runs on the client machine and forwards all the traffic to a ssh tunnel. Since its open source it holds quite a lot of major advantages over traditional VPN.  OpenSSH 8.1 Released  Security  ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): an exploitable integer overflow bug was found in the private key parsing code for the XMSS key type. This key type is still experimental and support for it is not compiled by default. No user-facing autoconf option exists in portable OpenSSH to enable it. This bug was found by Adam Zabrocki and reported via SecuriTeam's SSD program. ssh(1), sshd(8), ssh-agent(1): add protection for private keys at rest in RAM against speculation and memory side-channel attacks like Spectre, Meltdown and Rambleed. This release encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large "prekey" consisting of random data (currently 16KB).  This release includes a number of changes that may affect existing configurations:  ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. Certificates signed by RSA keys will therefore be incompatible with OpenSSH versions prior to 7.2 unless the default is overridden (using "ssh-keygen -t ssh-rsa -s ...").  New Features  ssh(1): Allow %n to be expanded in ProxyCommand strings ssh(1), sshd(8): Allow prepending a list of algorithms to the default set by starting the list with the '' character, E.g. "HostKeyAlgorithms ssh-ed25519" ssh-keygen(1): add an experimental lightweight signature and verification ability. Signatures may be made using regular ssh keys held on disk or stored in a ssh-agent and verified against an authorized_keys-like list of allowed keys. Signatures embed a namespace that prevents confusion and attacks between different usage domains (e.g. files vs email). ssh-keygen(1): print key comment when extracting public key from a private key. ssh-keygen(1): accept the verbose flag when searching for host keys in known hosts (i.e. "ssh-keygen -vF host") to print the matching host's random-art signature too. All: support PKCS8 as an optional format for storage of private keys to disk.  The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less insecure key derivation function than PEM's.   Beastie Bits  Say goodbye to the 32 CPU limit in NetBSD/aarch64 vBSDcon 2019 videos Browse the web in the terminal - W3M NetBSD 9 and GSoC BSDCan 2019 Videos NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open FOSDEM 2020 - BSD Devroom Call for Participation University of Cambridge looking for Research Assistants/Associates  Feedback/Questions  Trenton - Beeping Thinkpad Alex - Per user ZFS Datasets  Allan’s old patch from 2015  Javier - FBSD 12.0 + ZFS + encryption   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv        Your browser does not support the HTML5 video tag.

<p>Unix is 50, Hunting down Ken's PDP-7, OpenBSD and OPNSense have new releases, Clarification on what GhostBSD is, sshuttle  - VPN over SSH, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.bell-labs.com/unix50/" rel="nofollow" target="_blank">Unix is 50</a></h3> <blockquote> <p>In the summer of 1969 computer scientists Ken Thompson and Dennis Ritchie created the first implementation of Unix with the goal of designing an elegant and economical operating system for a little-used PDP-7 minicomputer at Bell Labs. That modest project, however, would have a far-reaching legacy. Unix made large-scale networking of diverse computing systems — and the Internet — practical. The Unix team went on to develop the C language, which brought an unprecedented combination of efficiency and expressiveness to programming. Both made computing more "portable". Today, Linux, the most popular descendent of Unix, powers the vast majority of servers, and elements of Unix and Linux are found in most mobile devices. Meanwhile C++ remains one of the most widely used programming languages today. Unix may be a half-century old but its influence is only growing.</p> </blockquote> <h3><a href="https://bsdimp.blogspot.com/2019/10/video-footage-of-first-pdp-7-to-run-unix.html" rel="nofollow" target="_blank">Hunting down Ken's PDP-7: video footage found</a></h3> <blockquote> <p>In my prior blog post, I traced Ken's scrounged PDP-7 to SN 34. In this post I'll show that we have actual video footage of that PDP-7 due to an old film from Bell Labs. this gives us almost a minute of footage of the PDP-7 Ken later used to create Unix.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://openbsd.org/66.html" rel="nofollow" target="_blank">OpenBSD 6.6 Released</a></h3> <ul> <li>Announce: <a href="https://marc.info/?l=openbsd-tech&amp;m=157132024225971&amp;w=2" rel="nofollow" target="_blank">https://marc.info/?l=openbsd-tech&amp;m=157132024225971&amp;w=2</a></li> <li>Upgrade Guide: <a href="https://openbsd.org/faq/upgrade66.html" rel="nofollow" target="_blank">https://openbsd.org/faq/upgrade66.html</a></li> <li>Changelog: <a href="https://openbsd.org/plus66.html" rel="nofollow" target="_blank">https://openbsd.org/plus66.html</a></li> </ul> <h3><a href="https://opnsense.org/opnsense-19-7-5-released/" rel="nofollow" target="_blank">OPNsense 19.7.5 released</a></h3> <blockquote> <p>Hello friends and followers, Lots of plugin and ports updates this time with a few minor improvements in all core areas. Behind the scenes we are starting to migrate the base system to version</p> </blockquote> <p>12.1 which is supposed to hit the next 20.1 release.  Stay tuned for more infos in the next month or so.</p> <p>Here are the full patch notes:</p> <ul> <li>system: show all swap partitions in system information widget</li> <li>system: flatten services_get() in preparation for removal</li> <li>system: pin Syslog-ng version to specific package name</li> <li>system: fix LDAP/StartTLS with user import page</li> <li>system: fix a PHP warning on authentication server page</li> <li>system: replace most subprocess.call use</li> <li>interfaces: fix devd handling of carp devices (contributed by stumbaumr)</li> <li>firewall: improve firewall rules inline toggles</li> <li>firewall: only allow TCP flags on TCP protocol</li> <li>firewall: simplify help text for direction setting</li> <li>firewall: make protocol log summary case insensitive</li> <li>reporting: ignore malformed flow records</li> <li>captive portal: fix type mismatch for timeout read</li> <li>dhcp: add note for static lease limitation with lease registration (contributed by Northguy)</li> <li>ipsec: add margintime and rekeyfuzz options</li> <li>ipsec: clear $dpdline correctly if not set</li> <li>ui: fix tokenizer reorder on multiple saves</li> <li>plugins: os-acme-client 1.26[1]</li> <li>plugins: os-bind will reload bind on record change (contributed by blablup)</li> <li>plugins: os-etpro-telemetry minor subprocess.call replacement</li> <li>plugins: os-freeradius 1.9.4[2]</li> <li>plugins: os-frr 1.12[3]</li> <li>plugins: os-haproxy 2.19[4]</li> <li>plugins: os-mailtrail 1.2[5]</li> <li>plugins: os-postfix 1.11[6]</li> <li>plugins: os-rspamd 1.8[7]</li> <li>plugins: os-sunnyvalley LibreSSL support (contributed by Sunny Valley Networks)</li> <li>plugins: os-telegraf 1.7.6[8]</li> <li>plugins: os-theme-cicada 1.21 (contributed by Team Rebellion)</li> <li>plugins: os-theme-tukan 1.21 (contributed by Team Rebellion)</li> <li>plugins: os-tinc minor subprocess.call replacement</li> <li>plugins: os-tor 1.8 adds dormant mode disable option (contributed by Fabian Franz)</li> <li>plugins: os-virtualbox 1.0 (contributed by andrewhotlab)</li> </ul> <h3><a href="http://ghostbsd.org/node/194" rel="nofollow" target="_blank">Dealing with the misunderstandings of what is GhostBSD</a></h3> <blockquote> <p>Since the release of 19.09, I have seen a lot of misunderstandings on what is GhostBSD and the future of GhostBSD. GhostBSD is based on TrueOS with FreeBSD 12 STABLE with our twist to it. We are still continuing to use TrueOS for OpenRC, and the new package's system for the base system that is built from ports. GhostBSD is becoming a slow-moving rolling release base on the latest TrueOS with FreeBSD 12 STABLE. When FreeBSD 13 STABLE gets released, GhostBSD will be upgraded to TrueOS with FreeBSD 13 STABLE.</p> <p>Our official desktop is MATE, which means that the leading developer of GhostBSD does not officially support XFCE. Community releases are maintained by the community and for the community. GhostBSD project will provide help to build and to host the community release. If anyone wants to have a particular desktop supported, it is up to the community. Sure I will help where I can, answer questions and guide new community members that contribute to community release.</p> <p>There is some effort going on for Plasma5 desktop. If anyone is interested in helping with XFCE and Plasma5 or in creating another community release, you are well come to contribute. Also, Contribution to the GhostBSD base system, to ports and new ports, and in house software are welcome. We are mostly active on Telegram <a href="https://t.me/ghostbsd" rel="nofollow" target="_blank">https://t.me/ghostbsd</a>, but you can also reach us on the forum.</p> </blockquote> <h3><a href="https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn-alternative/" rel="nofollow" target="_blank">SHUTTLE – VPN over SSH | VPN Alternative</a></h3> <blockquote> <p>Looking for a lightweight VPN client, but are not ready to spend a monthly recurring amount on a VPN? VPNs can be expensive depending upon the quality of service and amount of privacy you want. A good VPN plan can easily set you back by 10$ a month and even that doesn’t guarantee your privacy. There is no way to be sure whether the VPN is storing your confidential information and traffic logs or not. sshuttle is the answer to your problem it provides VPN over ssh and in this article we’re going to explore this cheap yet powerful alternative to the expensive VPNs. By using open source tools you can control your own privacy.</p> </blockquote> <ul> <li>VPN over SSH – sshuttle</li> </ul> <blockquote> <p>sshuttle is an awesome program that allows you to create a VPN connection from your local machine to any remote server that you have ssh access on. The tunnel established over the ssh connection can then be used to route all your traffic from client machine through the remote machine including all the dns traffic. In the bare bones sshuttle is just a proxy server which runs on the client machine and forwards all the traffic to a ssh tunnel. Since its open source it holds quite a lot of major advantages over traditional VPN.</p> </blockquote> <h3><a href="http://www.openssh.com/txt/release-8.1" rel="nofollow" target="_blank">OpenSSH 8.1 Released</a></h3> <ul> <li><p>Security</p> <ul> <li>ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): an exploitable integer overflow bug was found in the private key parsing code for the XMSS key type. This key type is still experimental and support for it is not compiled by default. No user-facing autoconf option exists in portable OpenSSH to enable it. This bug was found by Adam Zabrocki and reported via SecuriTeam's SSD program.</li> <li>ssh(1), sshd(8), ssh-agent(1): add protection for private keys at rest in RAM against speculation and memory side-channel attacks like Spectre, Meltdown and Rambleed. This release encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large "prekey" consisting of random data (currently 16KB).</li> </ul></li> <li><p>This release includes a number of changes that may affect existing configurations:</p> <ul> <li>ssh-keygen(1): when acting as a CA and signing certificates with an RSA key, default to using the rsa-sha2-512 signature algorithm. Certificates signed by RSA keys will therefore be incompatible with OpenSSH versions prior to 7.2 unless the default is overridden (using "ssh-keygen -t ssh-rsa -s ...").</li> </ul></li> <li><p>New Features</p> <ul> <li>ssh(1): Allow %n to be expanded in ProxyCommand strings</li> <li>ssh(1), sshd(8): Allow prepending a list of algorithms to the default set by starting the list with the '' character, E.g. "HostKeyAlgorithms ssh-ed25519"</li> <li>ssh-keygen(1): add an experimental lightweight signature and verification ability. Signatures may be made using regular ssh keys held on disk or stored in a ssh-agent and verified against an authorized_keys-like list of allowed keys. Signatures embed a namespace that prevents confusion and attacks between different usage domains (e.g. files vs email).</li> <li>ssh-keygen(1): print key comment when extracting public key from a private key.</li> <li>ssh-keygen(1): accept the verbose flag when searching for host keys in known hosts (i.e. "ssh-keygen -vF host") to print the matching host's random-art signature too.</li> <li>All: support PKCS8 as an optional format for storage of private keys to disk.  The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less insecure key derivation function than PEM's.</li> </ul></li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://twitter.com/jmcwhatever/status/1185584719183962112" rel="nofollow" target="_blank">Say goodbye to the 32 CPU limit in NetBSD/aarch64</a></li> <li><a href="https://www.youtube.com/channel/UCvcdrOSlYOSzOzLjv_n1_GQ/videos" rel="nofollow" target="_blank">vBSDcon 2019 videos</a></li> <li><a href="https://www.youtube.com/watch?v=3Hfda0Tjqsg&amp;feature=youtu.be" rel="nofollow" target="_blank">Browse the web in the terminal - W3M</a></li> <li><a href="http://netbsd.org/%7Ekamil/GSoC2019.html#slide1" rel="nofollow" target="_blank">NetBSD 9 and GSoC</a></li> <li><a href="https://www.youtube.com/playlist?list=PLeF8ZihVdpFegPoAKppaDSoYmsBvpnSZv" rel="nofollow" target="_blank">BSDCan 2019 Videos</a></li> <li><a href="https://www.nycbug.org/index?action=view&amp;id=10673" rel="nofollow" target="_blank">NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders</a></li> <li><a href="https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/" rel="nofollow" target="_blank">FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open</a></li> <li><a href="https://people.freebsd.org/%7Erodrigo/fosdem20/" rel="nofollow" target="_blank">FOSDEM 2020 - BSD Devroom Call for Participation</a></li> <li><a href="https://twitter.com/ed_maste/status/1184865668317007874" rel="nofollow" target="_blank">University of Cambridge looking for Research Assistants/Associates</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Trenton - <a href="http://dpaste.com/0ZEXNM6#wrap" rel="nofollow" target="_blank">Beeping Thinkpad</a></li> <li>Alex - <a href="http://dpaste.com/1K31A65#wrap" rel="nofollow" target="_blank">Per user ZFS Datasets</a> <ul> <li><a href="https://reviews.freebsd.org/D2272" rel="nofollow" target="_blank">Allan’s old patch from 2015</a></li> </ul></li> <li>Javier - <a href="http://dpaste.com/1XX4NNA#wrap" rel="nofollow" target="_blank">FBSD 12.0 + ZFS + encryption</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li></ul>    <br>    Your browser does not support the HTML5 video tag.

322: Happy Birthday, Unix

Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more. Headlines The happinesses and stresses of full-time FOSS work  In the past few days, several free software maintainers have come out to discuss the stresses of their work. Though the timing was suggestive, my article last week on the philosophy of project governance was, at best, only tangentially related to this topic - I had been working on that article for a while. I do have some thoughts that I’d like to share about what kind of stresses I’ve dealt with as a FOSS maintainer, and how I’ve managed (or often mismanaged) it. February will mark one year that I’ve been working on self-directed free software projects full-time. I was planning on writing an optimistic retrospective article around this time, but given the current mood of the ecosystem I think it would be better to be realistic. In this stage of my career, I now feel at once happier, busier, more fulfilled, more engaged, more stressed, and more depressed than I have at any other point in my life. The good parts are numerous. I’m able to work on my life’s passions, and my projects are in the best shape they’ve ever been thanks to the attention I’m able to pour into them. I’ve also been able to do more thoughtful, careful work; with the extra time I’ve been able to make my software more robust and reliable than it’s ever been. The variety of projects I can invest my time into has also increased substantially, with what was once relegated to minor curiosities now receiving a similar amount of attention as my larger projects were receiving in my spare time before. I can work from anywhere in the world, at any time, not worrying about when to take time off and when to put my head down and crank out a lot of code. The frustrations are numerous, as well. I often feel like I’ve bit off more than I can chew. This has been the default state of affairs for me for a long time; I’m often neglecting half of my projects in order to obtain progress by leaps and bounds in just a few. Working on FOSS full-time has cast this model’s disadvantages into greater relief, as I focus on a greater breadth of projects and spend more time on them.  Building a FreeBSD File Server  Recently at my job, I was faced with a task to develop a file server explicitly suited for the requirements of the company. Needless to say, any configuration of a kind depends on what the infrastructure needs. So, drawing from my personal experience and numerous materials on the web, I came up with the combination FreeBSD+SAMBA+AD as the most appropriate. It appears to be a perfect choice for this environment, and harmonic addition to the existing network configuration since FreeBSD + SAMBA + AD enables admins with the broad range of possibilities for access control. However, as nothing is perfect, this configuration isn’t the best choice if your priority is data protection because it won’t be able to reach the necessary levels of reliability and fault tolerance without outside improvements. Now, since we’ve established that, let’s move on to the next point. This article’s describing the process of building a test environment while concentrating primarily on the details of the configuration. As the author, though, I must say I’m in no way suggesting that this is the only way! The following configuration will be presented in its initial stage, with the minimum requirements necessary to get the job done, and its purpose in one specific situation only. Here, look at this as a useful strategy to solve similar tasks. Well, let’s get started!  Report from the first Hamilton BSD Users Group Meeting  February 11th was the first meeting of this new user group, founded by John Young and myself 11 people attended, and a lot of good discussions were had One of the attendees already owns a domain that fits well for the group, so we will be getting that setup over the next few weeks, as well as the twitter account, and other organization stuff. Special thanks to the illumos users who drove in from Buffalo to attend, although they may have actually had a shorter drive than a few of the other attendees. The next meeting is scheduled again for the 2nd Tuesday of the month, March 10th. We are still discussing if we should meet at a restaurant again, or try to get a space at the local college or innovation hub where we can have a projector etc.  News Roundup Kubernetes on FreeBSD Bhyve  There are quite a few solutions for container orchestration, but the most popular (or the most famous and highly advertised, is probably, a Kubernetes) Since I plan to conduct many experiments with installing and configuring k8s, I need a laboratory in which I can quickly and easily deploy a cluster in any quantities for myself. In my work and everyday life I use two OS very tightly - Linux and FreeBSD OS. Kubernetes and docker are Linux-centric projects, and at first glance, you should not expect any useful participation and help from FreeBSD here. As the saying goes, an elephant can be made out of a fly, but it will no longer fly. However, two tempting things come to mind - this is very good integration and work in the FreeBSD ZFS file system, from which it would be nice to use the snapshot mechanism, COW and reliability. And the second is the bhyve hypervisor, because we still need the docker and k8s loader in the form of the Linux kernel. Thus, we need to connect a certain number of actions in various ways, most of which are related to starting and pre-configuring virtual machines. This is typical of both a Linux-based server and FreeBSD. What exactly will work under the hood to run virtual machines does not play a big role. And if so - let's take a FreeBSD here!  NetBSD 9 RC1 Available  We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).   Here are a few highlights of the new release:  Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady" compliant machines (SBBR+SBSA) Enhanced hardware support for Armv7-A Updated GPU drivers (e.g. support for Intel Kabylake) Enhanced virtualization support Support for hardware-accelerated virtualization (NVMM) Support for Performance Monitoring Counters Support for Kernel ASLR Support several kernel sanitizers (KLEAK, KASAN, KUBSAN) Support for userland sanitizers Audit of the network stack Many improvements in NPF Updated ZFS Reworked error handling and NCQ support in the SATA subsystem Support a common framework for USB Ethernet drivers (usbnet)  You can download binaries of NetBSD 9.0_RC1 from our Fastly-provided CDN: https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/  OPNsense 20.1 Keen Kingfisher released  For over 5 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing. 20.1, nicknamed "Keen Kingfisher", is a subtle improvement on sustainable firewall experience. This release adds VXLAN and additional loopback device support, IPsec public key authentication and elliptic curve TLS certificate creation amongst others. Third party software has been updated to their latest versions. The logging frontend was rewritten for MVC with seamless API support. On the far side the documentation increased in quality as well as quantity and now presents itself in a familiar menu layout.  Idealistic Future for HardenedBSD  Over the past month, we purchased and deployed the new 13-CURRENT/amd64 package building server. We published our first 13-CURRENT/amd64 production package build using that server. We then rebuilt the old package building server to act as the 12-STABLE/amd64 package building server. This post signifies a very important milestone: we have now fully recovered from last year's death of our infrastructure. Our 12-STABLE/amd64 repo, previously out-of-date by many months, is now fully up-to-date! HardenedBSD is in a very unique position to provide innovative solutions to at-risk and underprivileged populations. As such, we are making human rights endeavors a defining area of focus. Our infrastructure will integrate various privacy and anonymity enhancing technologies and techniques to protect lives. Our operating system's security posture will increase, especially with our focus on exploit mitigations. Navigating the intersection between human rights and information security directly impacts lives. HardenedBSD's 2020 mission and focus is to deliver an entire hardened ecosystem that is unfriendly towards those who would oppress or censor their people. This includes a subtle shift in priorities to match this new mission and focus. While we implement exploit mitigations and further harden the ecosystem, we will seek out opportunities to contribute a tangible and unique impact on human rights issues. Providing Tor Onion Services for our core infrastructure is the first step in likely many to come towards securely helping those in need.  Beastie Bits  Warner Losh's FOSDEM talk Relational Pipes v0.15 A reminder for where to find NetBSD ARM images New Safe Memory Reclamation feature in UMA BSD Users Stockholm Meetup  Feedback/Questions  ZFS - Rosetta Stone Document? Pat - Question Sigflup - Wayland on the BSDs   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv        Your browser does not support the HTML5 video tag.

<p>Happinesses and stresses of full-time FOSS work, building a FreeBSD fileserver, Kubernetes on FreeBSD bhyve, NetBSD 9 RC1 available, OPNSense 20.1 is here, HardenedBSD’s idealistic future, and more.</p> <h2>Headlines</h2> <h3><a href="https://drewdevault.com//2020/01/21/Stress-and-happiness.html" rel="nofollow" target="_blank">The happinesses and stresses of full-time FOSS work</a></h3> <blockquote> <p>In the past few days, several free software maintainers have come out to discuss the stresses of their work. Though the timing was suggestive, my article last week on the philosophy of project governance was, at best, only tangentially related to this topic - I had been working on that article for a while. I do have some thoughts that I’d like to share about what kind of stresses I’ve dealt with as a FOSS maintainer, and how I’ve managed (or often mismanaged) it.</p> <p>February will mark one year that I’ve been working on self-directed free software projects full-time. I was planning on writing an optimistic retrospective article around this time, but given the current mood of the ecosystem I think it would be better to be realistic. In this stage of my career, I now feel at once happier, busier, more fulfilled, more engaged, more stressed, and more depressed than I have at any other point in my life.</p> <p>The good parts are numerous. I’m able to work on my life’s passions, and my projects are in the best shape they’ve ever been thanks to the attention I’m able to pour into them. I’ve also been able to do more thoughtful, careful work; with the extra time I’ve been able to make my software more robust and reliable than it’s ever been. The variety of projects I can invest my time into has also increased substantially, with what was once relegated to minor curiosities now receiving a similar amount of attention as my larger projects were receiving in my spare time before. I can work from anywhere in the world, at any time, not worrying about when to take time off and when to put my head down and crank out a lot of code.</p> <p>The frustrations are numerous, as well. I often feel like I’ve bit off more than I can chew. This has been the default state of affairs for me for a long time; I’m often neglecting half of my projects in order to obtain progress by leaps and bounds in just a few. Working on FOSS full-time has cast this model’s disadvantages into greater relief, as I focus on a greater breadth of projects and spend more time on them.</p> </blockquote> <h3><a href="https://www.vmwareblog.org/building-freebsd-file-server/" rel="nofollow" target="_blank">Building a FreeBSD File Server</a></h3> <blockquote> <p>Recently at my job, I was faced with a task to develop a file server explicitly suited for the requirements of the company. Needless to say, any configuration of a kind depends on what the infrastructure needs. So, drawing from my personal experience and numerous materials on the web, I came up with the combination FreeBSD+SAMBA+AD as the most appropriate. It appears to be a perfect choice for this environment, and harmonic addition to the existing network configuration since FreeBSD + SAMBA + AD enables admins with the broad range of possibilities for access control. However, as nothing is perfect, this configuration isn’t the best choice if your priority is data protection because it won’t be able to reach the necessary levels of reliability and fault tolerance without outside improvements.</p> <p>Now, since we’ve established that, let’s move on to the next point. This article’s describing the process of building a test environment while concentrating primarily on the details of the configuration. As the author, though, I must say I’m in no way suggesting that this is the only way! The following configuration will be presented in its initial stage, with the minimum requirements necessary to get the job done, and its purpose in one specific situation only. Here, look at this as a useful strategy to solve similar tasks. Well, let’s get started!</p> </blockquote> <h3><a href="https://twitter.com/hambug_ca/status/1227664949914349569" rel="nofollow" target="_blank">Report from the first Hamilton BSD Users Group Meeting</a></h3> <blockquote> <p>February 11th was the first meeting of this new user group, founded by John Young and myself</p> <p>11 people attended, and a lot of good discussions were had</p> <p>One of the attendees already owns a domain that fits well for the group, so we will be getting that setup over the next few weeks, as well as the twitter account, and other organization stuff.</p> <p>Special thanks to the illumos users who drove in from Buffalo to attend, although they may have actually had a shorter drive than a few of the other attendees.</p> <p>The next meeting is scheduled again for the 2nd Tuesday of the month, March 10th.</p> <p>We are still discussing if we should meet at a restaurant again, or try to get a space at the local college or innovation hub where we can have a projector etc.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://www.bsdstore.ru/en/articles/cbsd_k8s_part1.html" rel="nofollow" target="_blank">Kubernetes on FreeBSD Bhyve</a></h3> <blockquote> <p>There are quite a few solutions for container orchestration, but the most popular (or the most famous and highly advertised, is probably, a Kubernetes) Since I plan to conduct many experiments with installing and configuring k8s, I need a laboratory in which I can quickly and easily deploy a cluster in any quantities for myself. In my work and everyday life I use two OS very tightly - Linux and FreeBSD OS. Kubernetes and docker are Linux-centric projects, and at first glance, you should not expect any useful participation and help from FreeBSD here. As the saying goes, an elephant can be made out of a fly, but it will no longer fly. However, two tempting things come to mind - this is very good integration and work in the FreeBSD ZFS file system, from which it would be nice to use the snapshot mechanism, COW and reliability. And the second is the bhyve hypervisor, because we still need the docker and k8s loader in the form of the Linux kernel. Thus, we need to connect a certain number of actions in various ways, most of which are related to starting and pre-configuring virtual machines. This is typical of both a Linux-based server and FreeBSD. What exactly will work under the hood to run virtual machines does not play a big role. And if so - let's take a FreeBSD here!</p> </blockquote> <h3><a href="http://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd" rel="nofollow" target="_blank">NetBSD 9 RC1 Available</a></h3> <blockquote> <p>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</p> </blockquote> <ul> <li><p>Here are a few highlights of the new release:</p> <ul> <li>Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady" compliant machines (SBBR+SBSA)</li> <li>Enhanced hardware support for Armv7-A</li> <li>Updated GPU drivers (e.g. support for Intel Kabylake)</li> <li>Enhanced virtualization support</li> <li>Support for hardware-accelerated virtualization (NVMM)</li> <li>Support for Performance Monitoring Counters</li> <li>Support for Kernel ASLR</li> <li>Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)</li> <li>Support for userland sanitizers</li> <li>Audit of the network stack</li> <li>Many improvements in NPF</li> <li>Updated ZFS</li> <li>Reworked error handling and NCQ support in the SATA subsystem</li> <li>Support a common framework for USB Ethernet drivers (usbnet)</li> </ul></li> <li><p>You can download binaries of NetBSD 9.0_RC1 from our Fastly-provided CDN: <a href="https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/" rel="nofollow" target="_blank">https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0_RC1/</a></p></li> </ul> <h3><a href="https://opnsense.org/opnsense-20-1-keen-kingfisher-released/" rel="nofollow" target="_blank">OPNsense 20.1 Keen Kingfisher released</a></h3> <blockquote> <p>For over 5 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing.</p> <p>20.1, nicknamed "Keen Kingfisher", is a subtle improvement on sustainable firewall experience. This release adds VXLAN and additional loopback device support, IPsec public key authentication and elliptic curve TLS certificate creation amongst others. Third party software has been updated to their latest versions. The logging frontend was rewritten for MVC with seamless API support. On the far side the documentation increased in quality as well as quantity and now presents itself in a familiar menu layout.</p> </blockquote> <h3><a href="https://hardenedbsd.org/article/shawn-webb/2020-01-26/idealistic-future-hardenedbsd" rel="nofollow" target="_blank">Idealistic Future for HardenedBSD</a></h3> <blockquote> <p>Over the past month, we purchased and deployed the new 13-CURRENT/amd64 package building server. We published our first 13-CURRENT/amd64 production package build using that server. We then rebuilt the old package building server to act as the 12-STABLE/amd64 package building server. This post signifies a very important milestone: we have now fully recovered from last year's death of our infrastructure. Our 12-STABLE/amd64 repo, previously out-of-date by many months, is now fully up-to-date!</p> <p>HardenedBSD is in a very unique position to provide innovative solutions to at-risk and underprivileged populations. As such, we are making human rights endeavors a defining area of focus. Our infrastructure will integrate various privacy and anonymity enhancing technologies and techniques to protect lives. Our operating system's security posture will increase, especially with our focus on exploit mitigations.</p> <p>Navigating the intersection between human rights and information security directly impacts lives. HardenedBSD's 2020 mission and focus is to deliver an entire hardened ecosystem that is unfriendly towards those who would oppress or censor their people. This includes a subtle shift in priorities to match this new mission and focus. While we implement exploit mitigations and further harden the ecosystem, we will seek out opportunities to contribute a tangible and unique impact on human rights issues. Providing Tor Onion Services for our core infrastructure is the first step in likely many to come towards securely helping those in need.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://fosdem.org/2020/interviews/warner-losh/" rel="nofollow" target="_blank">Warner Losh's FOSDEM talk</a></li> <li><a href="https://relational-pipes.globalcode.info/v_0/release-v0.15.xhtml" rel="nofollow" target="_blank">Relational Pipes v0.15</a></li> <li><a href="http://www.armbsd.org/arm/" rel="nofollow" target="_blank">A reminder for where to find NetBSD ARM images</a></li> <li><a href="https://lists.freebsd.org/pipermail/freebsd-arch/2020-January/019866.html" rel="nofollow" target="_blank">New Safe Memory Reclamation feature in UMA</a></li> <li><a href="https://twitter.com/niclaszeising/status/1216667359831842817" rel="nofollow" target="_blank">BSD Users Stockholm Meetup</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>ZFS - <a href="http://dpaste.com/13EK8YH#wrap" rel="nofollow" target="_blank">Rosetta Stone Document?</a></li> <li>Pat - <a href="http://dpaste.com/2DN5RA4#wrap" rel="nofollow" target="_blank">Question</a></li> <li>Sigflup - <a href="http://dpaste.com/03Y4FQ7#wrap" rel="nofollow" target="_blank">Wayland on the BSDs</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li></ul>    <br>    Your browser does not support the HTML5 video tag.

337: Kubernetes on bhyve

OpenBSD 6.3 and DragonflyBSD 5.2 are released, bug fix for disappearing files in OpenZFS on Linux (and only Linux), understanding the FreeBSD CPU scheduler, NetBSD on RPI3, thoughts on being a committer for 20 years, and 5 reasons to use FreeBSD in 2018. Headlines OpenBSD 6.3 released  Punctual as ever, OpenBSD 6.3 has been releases with the following features/changes:  Improved HW support, including:  SMP support on OpenBSD/arm64 platforms  vmm/vmd improvements:  IEEE 802.11 wireless stack improvements  Generic network stack improvements  Installer improvements  Routing daemons and other userland network improvements  Security improvements  dhclient(8) improvements  Assorted improvements  OpenSMTPD 6.0.4  OpenSSH 7.7  LibreSSL 2.7.2  DragonFlyBSD 5.2 released  Big-ticket items  Meltdown and Spectre mitigation support  Meltdown isolation and spectre mitigation support added. Meltdown mitigation is automatically enabled for all Intel cpus. Spectre mitigation must be enabled manually via sysctl if desired, using sysctls machdep.spectremitigation and machdep.meltdownmitigation.  HAMMER2  H2 has received a very large number of bug fixes and performance improvements. We can now recommend H2 as the default root filesystem in non-clustered mode.  Clustered support is not yet available.  ipfw Updates  Implement state based "redirect", i.e. without using libalias.  ipfw now supports all possible ICMP types.  Fix ICMPMAXTYPE assumptions (now 40 as of this release).  Improved graphics support  The drm/i915 kernel driver has been updated to support Intel Coffeelake GPUs  Add 24-bit pixel format support to the EFI frame buffer code.  Significantly improve fbio support for the "scfb" XOrg driver. This allows EFI frame buffers to be used by X in situations where we do not otherwise support the GPU.  Partly implement the FBIOBLANK ioctl for display powersaving.  Syscons waits for drm modesetting at appropriate places, avoiding races.  + For more details, check out the “All changes since DragonFly 5.0” section.  ZFS on Linux bug causes files to disappear  A bug in ZoL 0.7.7 caused 0.7.8 to be released just 3 days after the release The bug only impacts Linux, the change that caused the problem was not upstreamed yet, so does not impact ZFS on illumos, FreeBSD, OS X, or Windows The bug can cause files being copied into a directory to not be properly linked to the directory, so they will no longer be listed in the contents of the directory ZoL developers are working on a tool to allow you to recover the data, since no data was actually lost, the files were just not properly registered as part of the directory The bug was introduced in a commit made in February, that attempted to improve performance of datasets created with the case insensitivity option. In an effort to improve performance, they introduced a limit to cap to give up (return ENOSPC) if growing the directory ZAP failed twice. The ZAP is the key-value pair data structure that contains metadata for a directory, including a hash table of the files that are in a directory. When a directory has a large number of files, the ZAP is converted to a FatZAP, and additional space may need to be allocated as additional files are added.  Commit cc63068 caused ENOSPC error when copy a large amount of files between two directories. The reason is that the patch limits zap leaf expansion to 2 retries, and return ENOSPC when failed. Finding the root cause of this issue was somewhat hampered by the fact that many people were not able to reproduce the issue. It turns out this was caused by an entirely unrelated change to GNU coreutils. On later versions of GNU Coreutils, the files were returned in a sorted order, resulting in them hitting different buckets in the hash table, and not tripping the retry limit Tools like rsync were unaffected, because they always sort the files before copying If you did not see any ENOSPC errors, you were likely not impacted  The intent for limiting retries is to prevent pointlessly growing table to max size when adding a block full of entries with same name in different case in mixed mode. However, it turns out we cannot use any limit on the retry. When we copy files from one directory in readdir order, we are copying in hash order, one leaf block at a time. Which means that if the leaf block in source directory has expanded 6 times, and you copy those entries in that block, by the time you need to expand the leaf in destination directory, you need to expand it 6 times in one go. So any limit on the retry will result in error where it shouldn't. Recommendations for Users from Ryan Yao:  The regression makes it so that creating a new file could fail with ENOSPC after which files created in that directory could become orphaned. Existing files seem okay, but I have yet to confirm that myself and I cannot speak for what others know. It is incredibly difficult to reproduce on systems running coreutils 8.23 or later. So far, reports have only come from people using coreutils 8.22 or older. The directory size actually gets incremented for each orphaned file, which makes it wrong after orphan files happen.  We will likely have some way to recover the orphaned files (like ext4’s lost+found) and fix the directory sizes in the very near future. Snapshots of the damaged datasets are problematic though. Until we have a subcommand to fix it (not including the snapshots, which we would have to list), the damage can be removed from a system that has it either by rolling back to a snapshot before it happened or creating a new dataset with 0.7.6 (or another release other than 0.7.7), moving everything to the new dataset and destroying the old. That will restore things to pristine condition.  It should also be possible to check for pools that are affected, but I have yet to finish my analysis to be certain that no false negatives occur when checking, so I will avoid saying how for now. Writes to existing files cannot trigger this bug, only adding new files to a directory in bulk  News Roundup des@’s thoughts on being a FreeBSD committer for 20 years  Yesterday was the twentieth anniversary of my FreeBSD commit bit, and tomorrow will be the twentieth anniversary of my first commit. I figured I’d split the difference and write a few words about it today. My level of engagement with the FreeBSD project has varied greatly over the twenty years I’ve been a committer. There have been times when I worked on it full-time, and times when I did not touch it for months. The last few years, health issues and life events have consumed my time and sapped my energy, and my contributions have come in bursts. Commit statistics do not tell the whole story, though: even when not working on FreeBSD directly, I have worked on side projects which, like OpenPAM, may one day find their way into FreeBSD. My contributions have not been limited to code. I was the project’s first Bugmeister; I’ve served on the Security Team for a long time, and have been both Security Officer and Deputy Security Officer; I managed the last four Core Team elections and am doing so again this year. In return, the project has taught me much about programming and software engineering. It taught me code hygiene and the importance of clarity over cleverness; it taught me the ins and outs of revision control; it taught me the importance of good documentation, and how to write it; and it taught me good release engineering practices. Last but not least, it has provided me with the opportunity to work with some of the best people in the field. I have the privilege today to count several of them among my friends. For better or worse, the FreeBSD project has shaped my career and my life. It set me on the path to information security in general and IAA in particular, and opened many a door for me. I would not be where I am now without it. I won’t pretend to be able to tell the future. I don’t know how long I will remain active in the FreeBSD project and community. It could be another twenty years; or it could be ten, or five, or less. All I know is that FreeBSD and I still have things to teach each other, and I don’t intend to call it quits any time soon.  iXsystems unveils new TrueNAS M-Series Unified Storage Line  San Jose, Calif., April 10, 2018 — iXsystems, the leader in Enterprise Open Source servers and software-defined storage, announced the TrueNAS M40 and M50 as the newest high-performance models in its hybrid, unified storage product line. The TrueNAS M-Series harnesses NVMe and NVDIMM to bring all-flash array performance to the award-winning TrueNAS hybrid arrays. It also includes the Intel® Xeon® Scalable Family of Processors and supports up to 100GbE and 32Gb Fibre Channel networking. Sitting between the all-flash TrueNAS Z50 and the hybrid TrueNAS X-Series in the product line, the TrueNAS M-Series delivers up to 10 Petabytes of highly-available and flash-powered network attached storage and rounds out a comprehensive product set that has a capacity and performance option for every storage budget.   Designed for On-Premises &amp; Enterprise Cloud Environments   As a unified file, block, and object sharing solution, TrueNAS can meet the needs of file serving, backup, virtualization, media production, and private cloud users thanks to its support for the SMB, NFS, AFP, iSCSI, Fibre Channel, and S3 protocols. At the heart of the TrueNAS M-Series is a custom 4U, dual-controller head unit that supports up to 24 3.5” drives and comes in two models, the M40 and M50, for maximum flexibility and scalability. The TrueNAS M40 uses NVDIMMs for write cache, SSDs for read cache, and up to two external 60-bay expansion shelves that unlock up to 2PB in capacity. The TrueNAS M50 uses NVDIMMs for write caching, NVMe drives for read caching, and up to twelve external 60-bay expansion shelves to scale upwards of 10PB. The dual-controller design provides high-availability failover and non-disruptive upgrades for mission-critical enterprise environments. By design, the TrueNAS M-Series unleashes cutting-edge persistent memory technology for demanding performance and capacity workloads, enabling businesses to accelerate enterprise applications and deploy enterprise private clouds that are twice the capacity of previous TrueNAS models. It also supports replication to the Amazon S3, BackBlaze B2, Google Cloud, and Microsoft Azure cloud platforms and can deliver an object store using the ubiquitous S3 object storage protocol at a fraction of the cost of the public cloud.   Fast   As a true enterprise storage platform, the TrueNAS M50 supports very demanding performance workloads with up to four active 100GbE ports, 3TB of RAM, 32GB of NVDIMM write cache and up to 15TB of NVMe flash read cache. The TrueNAS M40 and M50 include up to 24/7 and global next-business-day support, putting IT at ease. The modular and tool-less design of the M-Series allows for easy, non-disruptive servicing and upgrading by end-users and support technicians for guaranteed uptime. TrueNAS has US-Based support provided by the engineering team that developed it, offering the rapid response that every enterprise needs.   Award-Winning TrueNAS Features Enterprise: Perfectly suited for private clouds and enterprise workloads such as file sharing, backups, M&amp;E, surveillance, and hosting virtual machines. Unified: Utilizes SMB, AFP, NFS for file storage, iSCSI, Fibre Channel and OpenStack Cinder for block storage, and S3-compatible APIs for object storage. Supports every common operating system, hypervisor, and application. Economical: Deploy an enterprise private cloud and reduce storage TCO by 70% over AWS with built-in enterprise-class features such as in-line compression, deduplication, clones, and thin-provisioning. Safe: The OpenZFS file system ensures data integrity with best-in-class replication and snapshotting. Customers can replicate data to the rest of the iXsystems storage lineup and to the public cloud. Reliable: High Availability option with dual hot-swappable controllers for continuous data availability and 99.999% uptime. Familiar: Provision and manage storage with the same simple and powerful WebUI and REST APIs used in all iXsystems storage products, as well as iXsystems’ FreeNAS Software. Certified: TrueNAS has passed the Citrix Ready, VMware Ready, and Veeam Ready certifications, reducing the risk of deploying a virtualized infrastructure. Open: By using industry-standard sharing protocols, the OpenZFS Open Source enterprise file system and FreeNAS, the world’s #1 Open Source storage operating system (and also engineered by iXsystems), TrueNAS is the most open enterprise storage solution on the market. Availability   The TrueNAS M40 and M50 will be generally available in April 2018 through the iXsystems global channel partner network. The TrueNAS M-Series starts at under $20,000 USD and can be easily expanded using a linear “per terabyte” pricing model. With typical compression, a Petabtye can be stored for under $100,000 USD. TrueNAS comes with an all-inclusive software suite that provides NFS, Windows SMB, iSCSI, snapshots, clones and replication.   For more information, visit www.ixsystems.com/TrueNAS  TrueNAS M-Series What's New Video   Understanding and tuning the FreeBSD Scheduler  ```Occasionally I noticed that the system would not quickly process thetasks i need done, but instead prefer other, longrunning tasks. Ifigured it must be related to the scheduler, and decided it hates me. A closer look shows the behaviour as follows (single CPU): Lets run an I/O-active task, e.g, postgres VACUUM that wouldcontinuously read from big files (while doing compute as well [1]):  pool        alloc   free   read  write   read  write  cache           -      -      -      -      -      -   ada1s4    7.08G  10.9G  1.58K      0  12.9M      0  Now start an endless loop: while true; do :; done And the effect is:  pool        alloc   free   read  write   read  write  cache           -      -      -      -      -      -   ada1s4    7.08G  10.9G      9      0  76.8K      0  The VACUUM gets almost stuck! This figures with WCPU in "top":  PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND  85583 root        99    0  7044K  1944K RUN      1:06  92.21% bash  53005 pgsql       52    0   620M 91856K RUN      5:47   0.50% postgres  Hacking on kern.sched.quantum makes it quite a bit better: sysctl kern.sched.quantum=1 kern.sched.quantum: 94488 -&gt; 7874  pool        alloc   free   read  write   read  write  cache           -      -      -      -      -      -   ada1s4    7.08G  10.9G    395      0  3.12M      0 PID USERNAME   PRI NICE   SIZE    RES STATE    TIME    WCPU COMMAND  85583 root        94    0  7044K  1944K RUN      4:13  70.80% bash  53005 pgsql       52    0   276M 91856K RUN      5:52  11.83% postgres  Now, as usual, the "root-cause" questions arise: What exactly doesthis "quantum"? Is this solution a workaround, i.e. actually somethingelse is wrong, and has it tradeoff in other situations? Or otherwise,why is such a default value chosen, which appears to be ill-deceived? The docs for the quantum parameter are a bit unsatisfying - they sayits the max num of ticks a process gets - and what happens whenthey're exhausted? If by default the endless loop is actually allowedto continue running for 94k ticks (or 94ms, more likely) uninterrupted,then that explains the perceived behaviour - buts thats certainly notwhat a scheduler should do when other procs are ready to run. 11.1-RELEASE-p7, kern.hz=200. Switching tickless mode on or off doesnot influence the matter. Starting the endless loop with "nice" doesnot influence the matter. [1]A pure-I/O job without compute load, like "dd", does not showthis behaviour. Also, when other tasks are running, the unjustbehaviour is not so stongly pronounced.```  aarch64 support added  I have committed about adding initial support for aarch64.   booting log on RaspberryPI3:  ```    boot NetBSD/evbarm (aarch64)    Drop to EL1...OK    Creating VA=PA tables    Creating KSEG tables    Creating KVA=PA tables    Creating devmap tables    MMU Enable...OK    VSTART          = ffffffc000001ff4    FDT&lt;3ab46000&gt; devmap cpufunc bootstrap consinit ok    uboot: args 0x3ab46000, 0, 0, 0 NetBSD/evbarm (fdt) booting ...FDT /memory [0] @ 0x0 size 0x3b000000MEM: add 0-3b000000MEM: res 0-1000MEM: res 3ab46000-3ab4a000Usable memory:  1000 - 3ab45fff  3ab4a000 - 3affffffinitarm: kernel phys start 1000000 end 17bd000MEM: res 1000000-17bd000bootargs: root=axe0  1000 - ffffff  17bd000 - 3ab45fff  3ab4a000 - 3affffff------------------------------------------kern_vtopdiff         = 0xffffffbfff000000physical_start        = 0x0000000000001000kernel_start_phys     = 0x0000000001000000kernel_end_phys       = 0x00000000017bd000physical_end          = 0x000000003ab45000VM_MIN_KERNEL_ADDRESS = 0xffffffc000000000kernel_start_l2       = 0xffffffc000000000kernel_start          = 0xffffffc000000000kernel_end            = 0xffffffc0007bd000kernel_end_l2         = 0xffffffc000800000(kernel va area)(devmap va area)VM_MAX_KERNEL_ADDRESS = 0xffffffffffe00000------------------------------------------Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,    2018 The NetBSD Foundation, Inc.  All rights reserved.Copyright (c) 1982, 1986, 1989, 1991, 1993    The Regents of the University of California.  All rights reserved.NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018        ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64total memory = 936 MBavail memory = 877 MB … Starting local daemons:.Updating motd.Starting sshd.Starting inetd.Starting cron.The following components reported failures:    /etc/rc.d/swap2See /var/run/rc.log for more information.Fri Mar 30 12:35:31 JST 2018NetBSD/evbarm (rpi3) (console)login: rootLast login: Fri Mar 30 12:30:24 2018 on consolerpi3# uname -apNetBSD rpi3 8.99.14 NetBSD 8.99.14 (RPI64) #11: Fri Mar 30 12:34:19 JST 2018  ryo@moveq:/usr/home/ryo/tmp/netbsd-src-ryo-wip/sys/arch/evbarm/compile/RPI64 evbarm aarch64rpi3# ```  Now, multiuser mode works stably on fdt based boards (RPI3,SUNXI,TEGRA). But there are still some problems, more time is required for release. also SMP is not yet. See sys/arch/aarch64/aarch64/TODO for more detail. Especially the problems around TLS of rtld, and C++ stack unwindings are too difficult for me to solve, I give up and need someone's help (^o^)/ Since C++ doesn't work, ATF also doesn't work. If the ATF works, it will clarify more issues. sys/arch/evbarm64 is gone and integrated into sys/arch/evbarm. One evbarm/conf/GENERIC64 kernel binary supports all fdt (bcm2837,sunxi,tegra) based boards. While on 32bit, sys/arch/evbarm/conf/GENERIC will support all fdt based boards...but doesn't work yet. (WIP) My deepest appreciation goes to Tohru Nishimura (nisimura@) whose writes vector handlers, context switchings, and so on. and his comments and suggestions were innumerably valuable. I would also like to thank Nick Hudson (skrll@) and Jared McNeill (jmcneill@) whose added support FDT and integrated into evbarm. Finally, I would like to thank Matt Thomas (matt@) whose commited aarch64  toolchains and preliminary support for aarch64.   Beastie Bits  5 Reasons to Use FreeBSD in 2018 Rewriting Intel gigabit network driver in Rust Recruiting to make Elastic Search on FreeBSD better Windows Server 2019 Preview, in bhyve on FreeBSD “SSH Mastery, 2nd ed” in hardcover   Feedback/Questions  Jason - ZFS Transfer option Luis - ZFS Pools ClonOS  Michael - Tech Conferences anonymous - BSD trash on removable drives    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv

Episode 243: Understanding The Scheduler | BSD Now 243

How Intel docs were misinterpreted by almost any OS, a look at the mininet SDN emulator, do’s and don’ts for FreeBSD, OpenBSD community going gold, ed mastery is a must read, and the distributed object store minio on FreeBSD. Headlines Intel documentation flaw sees instruction misimplemented in almost every OS  A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash.   OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.    + A detailed white paper describes this behavior here   + FreeBSD Commit   Thank you to the MSRC Incident Response Team, and in particular Greg Lenti and Nate Warfield, for coordinating the response to this issue across multiple vendors.   Thanks to Computer Recycling at The Working Center of Kitchener for making hardware available to allow us to test the patch on additional CPU families.   + FreeBSD Security Advisory   + DragonFlyBSD Post   + NetBSD does not support debug register and so is not affected.   + OpenBSD also appears to not be affected, “We are not aware of further vendor information regarding this vulnerability.”   + IllumOS Not Impacted   Guest Post – A Look at SDN Emulator Mininet  A guest post on the FreeBSD Foundation’s blog by developer Ayaka Koshibe     At this year’s AsiaBSDCon, I presented a talk about a SDN network emulator called Mininet, and my ongoing work to make it more portable. That presentation was focused on the OpenBSD version of the port, and I breezed past the detail that I also had a version or Mininet working on FreeBSD. Because I was given the opportunity, I’d like to share a bit about the FreeBSD version of Mininet. It will not only be about what Mininet is and why it might be interesting, but also a recounting of my experience as a user making a first-time attempt at porting an application to FreeBSD.   Mininet started off as a tool used by academic researchers to emulate OpenFlow networks when they didn’t have convenient access to actual networks. Because of its history, Mininet became associated strongly with networks that use OpenFlow for their control channels. But, it has also become fairly popular among developers working in, and among several universities for research and teaching about, SDN (Software Defined Networking)   I began using Mininet as an intern at my university’s network research lab. I was using FreeBSD by that time, and wasn’t too happy to learn that Mininet wouldn’t work on anything but Linux. I gradually got tired of having to run a Linux VM just to use Mininet, and one day it clicked in my mind that I can actually try porting it to FreeBSD.   Mininet creates a topology using the resource virtualization features that Linux has. Specifically, nodes are bash processes running in network namespaces, and the nodes are interconnected using veth virtual Ethernet links. Switches and controllers are just nodes whose shells have run the right commands to configure a software switch or start a controller application. Mininet can therefore be viewed as a series of Python libraries that run the system commands necessary to create network namespaces and veth interfaces, assemble a specified topology, and coordinate how user commands aimed at nodes (since they are just shells) are run.   Coming back to the port, I chose to use vnet jails to replace the network namespaces, and epair(4) links to replace the veth links. For the SDN functionality, I needed at least one switch and controller that can be run on FreeBSD. I chose OpenvSwitch(OVS) for the switch, since it was available in ports and is well-known by the SDN world, and Ryu for the controller since it’s being actively developed and used and supports more recent versions of OpenFlow.   I have discussed the possibility of upstreaming my work. Although they were excited about it, I was asked about a script for creating VMs with Mininet preinstalled, and continuous integration support for my fork of the repository. I started taking a look at the release scripts for creating a VM, and after seeing that it would be much easier to use the scripts if I can get Mininet and Ryu added to the ports tree, I also tried a hand at submitting some ports. For CI support, Mininet uses Travis, which unfortunately doesn’t support FreeBSD. For this, I plan to look at a minimalistic CI tool called contbuild, which looks simple enough to get running and is written portably.   This is very much a work-in-progress, and one going at a glacial pace. Even though the company that I work for does use Mininet, but doesn’t use FreeBSD, so this is something that I’ve been working on in my free time. Earlier on, it was the learning curve that made progress slow. When I started, I hadn’t done anything more than run FreeBSD on a laptop, and uneventfully build a few applications from the ports tree. Right off the bat, using vnet jails meant learning how to build and run a custom kernel. This was the easy part, as the handbook was clear about how to do this. When I moved from using FreeBSD 10.3 to 11, I found that I can panic my machine by quickly creating and destroying OVS switches and jails. I submitted a bug report, but decided to go one step further and actually try to debug the panic for myself. With the help of a few people well-versed in systems programming and the developer’s handbook, I was able to come up with a fix, and get it accepted. This pretty much brings my porting experiment to the present day, where I’m slowly working out the pieces that I mentioned earlier.   In the beginning, I thought that this Mininet port would be a weekend project where I come out knowing thing or two about using vnet jails and with one less VM to run. Instead, it became a crash course in building and debugging kernels and submitting bug reports, patches, and ports. It’d like to mention that I wouldn’t have gotten far at all if it weren’t for the helpful folks, the documentation, and how debuggable FreeBSD is. I enjoy good challenges and learning experiences, and this has definitely been both. Thank you to Ayaka for working to port Mininet to the BSDs, and for sharing her experiences with us. If you want to see the OpenBSD version of the talk, the video from AsiaBSDCon is here, and it will be presented again at BSDCan.    iXsystems iXsystems LFNW Recap 10 Beginner Do's and Don't for FreeBSD  1) Don't mix ports and binary packages 2) Don't edit 'default' files 3) Don't mess with /etc/crontab 4) Don't mess with /etc/passwd and /etc/groups either! 5) Reconsider the removal of any options from your customized kernel configuration 6) Don't change the root shell to something else 7) Don't use the root user all the time 8) /var/backups is a thing 9) Check system integrity using /etc/mtree 10) What works for me doesn't have to work for you!   News Roundup OpenBSD Community Goes Gold for 2018!  Ken Westerback (krw@ when wearing his developer hat) writes:  ``` Monthly paypal donations from the OpenBSD community have made the community the OpenBSD Foundation's first Gold level contributor for 2018! 2018 is the third consecutive year that the community has reached Gold status or better. These monthly paypal commitments by the community are our most reliable source of funds and thus the most useful for financial planning purposes. We are extremely thankful for the continuing support and hope the community matches their 2017 achievement of Platinum status. Or even their 2016 achievement of Iridium status. Sign up now for a monthly donation! Note that Bitcoin contributions have been re-enabled now that our Bitcoin intermediary has re-certified our Canadian paperwork. https://www.openbsdfoundation.org/donations.html ```  ed(1) mastery is a must read for real unix people  In some circles on the Internet, your choice of text editor is a serious matter. We've all seen the threads on mailing lits, USENET news groups and web forums about the relative merits of Emacs vs vi, including endless iterations of flame wars, and sometimes even involving lesser known or non-portable editing environments. And then of course, from the Linux newbies we have seen an endless stream of tweeted graphical 'memes' about the editor vim (aka 'vi Improved') versus the various apparently friendlier-to-some options such as GNU nano. Apparently even the 'improved' version of the classical and ubiquitous vi(1) editor is a challenge even to exit for a significant subset of the younger generation. Yes, your choice of text editor or editing environment is a serious matter. Mainly because text processing is so fundamental to our interactions with computers. But for those of us who keep our systems on a real Unix (such as OpenBSD or FreeBSD), there is no real contest. The OpenBSD base system contains several text editors including vi(1) and the almost-emacs mg(1), but ed(1) remains the standard editor. Now Michael Lucas has written a book to guide the as yet uninitiated to the fundamentals of the original Unix text editor. It is worth keeping in mind that much of Unix and its original standard text editor written back when the standard output and default user interface was more likely than not a printing terminal. To some of us, reading and following the narrative of Ed Mastery is a trip down memory lane. To others, following along the text will illustrate the horror of the world of pre-graphic computer interfaces. For others again, the fact that ed(1) doesn't use your terminal settings much at all offers hope of fixing things when something or somebody screwed up your system so you don't have a working terminal for that visual editor.   DigitalOcean Digital Ocean Promo Link for BSD Now Listeners  Distributed Object Storage with Minio on FreeBSD  Free and open source distributed object storage server compatible with Amazon S3 v2/v4 API. Offers data protection against hardware failures using erasure code and bitrot detection. Supports highly available distributed setup. Provides confidentiality, integrity and authenticity assurances for encrypted data with negligible performance overhead. Both server side and client side encryption are supported. Below is the image of example Minio setup.   Architecture Diagram   The Minio identifies itself as the ZFS of Cloud Object Storage. This guide will show You how to setup highly available distributed Minio storage on the FreeBSD operating system with ZFS as backend for Minio data. For convenience we will use FreeBSD Jails operating system level virtualization.  Setup   The setup will assume that You have 3 datacenters and assumption that you have two datacenters in whose the most of the data must reside and that the third datacenter is used as a ‘quorum/witness’ role. Distributed Minio supports up to 16 nodes/drives total, so we may juggle with that number to balance data between desired datacenters. As we have 16 drives to allocate resources on 3 sites we will use 7 + 7 + 2 approach here. The datacenters where most of the data must reside have 7/16 ratio while the ‘quorum/witness’ datacenter have only 2/16 ratio. Thanks to built in Minio redundancy we may loose (turn off for example) any one of those machines and our object storage will still be available and ready to use for any purpose.   Jails   First we will create 3 jails for our proof of concept Minio setup, storage1 will have the ‘quorum/witness’ role while storage2 and storage3 will have the ‘data’ role. To distinguish commands I type on the host system and storageX Jail I use two different prompts, this way it should be obvious what command to execute and where.   WeI know the FreeNAS people have been working on integrating this   Best practises for pledge(2) security  Let's set the record straight for securing kcgi CGI and FastCGI applications with pledge(2). This is focussed on secure OpenBSD deployments.   Theory   Internally, kcgi makes considerable use of available security tools. But it's also designed to be invoked in a secure environment. We'll start with pledge(2), which has been around on OpenBSD since version 5.9. If you're reading this tutorial, you're probably on OpenBSD, and you probably have knowledge of pledge(2). How to begin? Read kcgi(3). It includes canonical information on which pledge(2) promises you'll need for each function in the library. This is just a tutorial—the manpage is canonical and overrides what you may read here. Next, assess the promises that your application needs. From kcgi(3), it's easy to see which promises we'll need to start. You'll need to augment this list with whichever tools you're also using. The general push is to start with the broadest set of required promises, then restrict as quickly as possible. Sometimes this can be done in a single pledge(2), but other times it takes a few.   Beastie Bits  April's London *BSD meetup - notes May’s London *BSD Meetup: May 22nd  Call for Papers for EuroBSDcon 2018 FreeBSD Journal March/April Desktop/Laptop issue LWN followup on the PostgreSQL fsync() issue The Association for Computing Machinery recognizes Steve Bourne for outstanding contributions   Feedback/Questions  Ray - Speaking at Conferences Casey - Questions Jeremy - zfs in the enterprise HAST + ZFS Lars - Civil Infrastructure Platform use of *BSD    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv 

<p>How Intel docs were misinterpreted by almost any OS, a look at the mininet SDN emulator, do’s and don’ts for FreeBSD, OpenBSD community going gold, ed mastery is a must read, and the distributed object store minio on FreeBSD.</p> <h2>Headlines</h2> <h3><a href="https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html" rel="nofollow" target="_blank">Intel documentation flaw sees instruction misimplemented in almost every OS</a></h3> <blockquote> <p>A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash.   OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.    + A detailed white paper describes this behavior <a href="http://everdox.net/popss.pdf" rel="nofollow" target="_blank">here</a>   + <a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=333368" rel="nofollow" target="_blank">FreeBSD Commit</a>   Thank you to the MSRC Incident Response Team, and in particular Greg Lenti and Nate Warfield, for coordinating the response to this issue across multiple vendors.   Thanks to Computer Recycling at The Working Center of Kitchener for making hardware available to allow us to test the patch on additional CPU families.   + <a href="https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc" rel="nofollow" target="_blank">FreeBSD Security Advisory</a>   + <a href="https://www.dragonflydigest.com/2018/05/09/21231.html" rel="nofollow" target="_blank">DragonFlyBSD Post</a>   + <a href="https://www.kb.cert.org/vuls/id/CHEU-AYC3MZ" rel="nofollow" target="_blank">NetBSD does not support debug register and so is not affected.</a>   + <a href="https://www.kb.cert.org/vuls/id/CHEU-AYC3MR" rel="nofollow" target="_blank">OpenBSD also appears to not be affected, “We are not aware of further vendor information regarding this vulnerability.”</a>   + <a href="https://illumos.topicbox.com/groups/developer/T9cd475bd5497caa9" rel="nofollow" target="_blank">IllumOS Not Impacted</a></p> </blockquote> <p></p> <h3><a href="https://www.freebsdfoundation.org/blog/guest-post-a-look-at-sdn-emulator-mininet/" rel="nofollow" target="_blank">Guest Post – A Look at SDN Emulator Mininet</a></h3> <ul> <li>A guest post on the FreeBSD Foundation’s blog by developer Ayaka Koshibe  <blockquote>   At this year’s AsiaBSDCon, I presented a talk about a SDN network emulator called Mininet, and my ongoing work to make it more portable. That presentation was focused on the OpenBSD version of the port, and I breezed past the detail that I also had a version or Mininet working on FreeBSD. Because I was given the opportunity, I’d like to share a bit about the FreeBSD version of Mininet. It will not only be about what Mininet is and why it might be interesting, but also a recounting of my experience as a user making a first-time attempt at porting an application to FreeBSD.   Mininet started off as a tool used by academic researchers to emulate OpenFlow networks when they didn’t have convenient access to actual networks. Because of its history, Mininet became associated strongly with networks that use OpenFlow for their control channels. But, it has also become fairly popular among developers working in, and among several universities for research and teaching about, SDN (Software Defined Networking)   I began using Mininet as an intern at my university’s network research lab. I was using FreeBSD by that time, and wasn’t too happy to learn that Mininet wouldn’t work on anything but Linux. I gradually got tired of having to run a Linux VM just to use Mininet, and one day it clicked in my mind that I can actually try porting it to FreeBSD.   Mininet creates a topology using the resource virtualization features that Linux has. Specifically, nodes are bash processes running in network namespaces, and the nodes are interconnected using veth virtual Ethernet links. Switches and controllers are just nodes whose shells have run the right commands to configure a software switch or start a controller application. Mininet can therefore be viewed as a series of Python libraries that run the system commands necessary to create network namespaces and veth interfaces, assemble a specified topology, and coordinate how user commands aimed at nodes (since they are just shells) are run.   Coming back to the port, I chose to use vnet jails to replace the network namespaces, and epair(4) links to replace the veth links. For the SDN functionality, I needed at least one switch and controller that can be run on FreeBSD. I chose OpenvSwitch(OVS) for the switch, since it was available in ports and is well-known by the SDN world, and Ryu for the controller since it’s being actively developed and used and supports more recent versions of OpenFlow.   I have discussed the possibility of upstreaming my work. Although they were excited about it, I was asked about a script for creating VMs with Mininet preinstalled, and continuous integration support for my fork of the repository. I started taking a look at the release scripts for creating a VM, and after seeing that it would be much easier to use the scripts if I can get Mininet and Ryu added to the ports tree, I also tried a hand at submitting some ports. For CI support, Mininet uses Travis, which unfortunately doesn’t support FreeBSD. For this, I plan to look at a minimalistic CI tool called contbuild, which looks simple enough to get running and is written portably.   This is very much a work-in-progress, and one going at a glacial pace. Even though the company that I work for does use Mininet, but doesn’t use FreeBSD, so this is something that I’ve been working on in my free time. Earlier on, it was the learning curve that made progress slow. When I started, I hadn’t done anything more than run FreeBSD on a laptop, and uneventfully build a few applications from the ports tree. Right off the bat, using vnet jails meant learning how to build and run a custom kernel. This was the easy part, as the handbook was clear about how to do this. When I moved from using FreeBSD 10.3 to 11, I found that I can panic my machine by quickly creating and destroying OVS switches and jails. I submitted a bug report, but decided to go one step further and actually try to debug the panic for myself. With the help of a few people well-versed in systems programming and the developer’s handbook, I was able to come up with a fix, and get it accepted. This pretty much brings my porting experiment to the present day, where I’m slowly working out the pieces that I mentioned earlier.   In the beginning, I thought that this Mininet port would be a weekend project where I come out knowing thing or two about using vnet jails and with one less VM to run. Instead, it became a crash course in building and debugging kernels and submitting bug reports, patches, and ports. It’d like to mention that I wouldn’t have gotten far at all if it weren’t for the helpful folks, the documentation, and how debuggable FreeBSD is. I enjoy good challenges and learning experiences, and this has definitely been both.</blockquote></li> <li>Thank you to Ayaka for working to port Mininet to the BSDs, and for sharing her experiences with us.</li> <li>If you want to see the OpenBSD version of the talk, the video from <a href="https://www.youtube.com/watch?v=Vg9Czjm9aV8" rel="nofollow" target="_blank">AsiaBSDCon is here</a>, and it will be presented again at BSDCan.</li> </ul> <p><br/> </p> <p><strong>iXsystems</strong><br/> <a href="https://www.ixsystems.com/blog/lfnw-2018-recap/" rel="nofollow" target="_blank">iXsystems LFNW Recap</a></p> <h3><a href="https://forums.freebsd.org/threads/10-dos-and-dont-for-freebsd.65618/" rel="nofollow" target="_blank">10 Beginner Do's and Don't for FreeBSD</a></h3> <ul> <li>1) Don't mix ports and binary packages</li> <li>2) Don't edit 'default' files</li> <li>3) Don't mess with /etc/crontab</li> <li>4) Don't mess with /etc/passwd and /etc/groups either!</li> <li>5) Reconsider the removal of any options from your customized kernel configuration</li> <li>6) Don't change the root shell to something else</li> <li>7) Don't use the root user all the time</li> <li>8) /var/backups is a thing</li> <li>9) Check system integrity using /etc/mtree</li> <li>10) What works for me doesn't have to work for you!</li> </ul> <p></p> <h2>News Roundup</h2> <h3><a href="https://undeadly.org/cgi?action=article;sid=20180419060427" rel="nofollow" target="_blank">OpenBSD Community Goes Gold for 2018!</a></h3> <ul> <li>Ken Westerback (krw@ when wearing his developer hat) writes:</li> </ul> <p>``` Monthly paypal donations from the OpenBSD community have made the community the OpenBSD Foundation's first Gold level contributor for 2018!</p> <p>2018 is the third consecutive year that the community has reached Gold status or better.</p> <p>These monthly paypal commitments by the community are our most reliable source of funds and thus the most useful for financial planning purposes. We are extremely thankful for the continuing support and hope the community matches their 2017 achievement of Platinum status. Or even their 2016 achievement of Iridium status.</p> <p>Sign up now for a monthly donation!</p> <p>Note that Bitcoin contributions have been re-enabled now that our Bitcoin intermediary has re-certified our Canadian paperwork.</p> <p><a href="https://www.openbsdfoundation.org/donations.html" rel="nofollow" target="_blank">https://www.openbsdfoundation.org/donations.html</a> ```</p> <p></p> <h3><a href="http://bsdly.blogspot.com/2018/04/ed1-mastery-is-must-for-real-unix-person.html" rel="nofollow" target="_blank">ed(1) mastery is a must read for real unix people</a></h3> <blockquote> <p>In some circles on the Internet, your choice of text editor is a serious matter.</p> <p>We've all seen the threads on mailing lits, USENET news groups and web forums about the relative merits of Emacs vs vi, including endless iterations of flame wars, and sometimes even involving lesser known or non-portable editing environments.</p> <p>And then of course, from the Linux newbies we have seen an endless stream of tweeted graphical 'memes' about the editor vim (aka 'vi Improved') versus the various apparently friendlier-to-some options such as GNU nano. Apparently even the 'improved' version of the classical and ubiquitous vi(1) editor is a challenge even to exit for a significant subset of the younger generation.</p> <p>Yes, your choice of text editor or editing environment is a serious matter. Mainly because text processing is so fundamental to our interactions with computers.</p> <p>But for those of us who keep our systems on a real Unix (such as OpenBSD or FreeBSD), there is no real contest. The OpenBSD base system contains several text editors including vi(1) and the almost-emacs mg(1), but ed(1) remains the standard editor.</p> <p>Now Michael Lucas has written a book to guide the as yet uninitiated to the fundamentals of the original Unix text editor. It is worth keeping in mind that much of Unix and its original standard text editor written back when the standard output and default user interface was more likely than not a printing terminal.</p> <p>To some of us, reading and following the narrative of Ed Mastery is a trip down memory lane. To others, following along the text will illustrate the horror of the world of pre-graphic computer interfaces. For others again, the fact that ed(1) doesn't use your terminal settings much at all offers hope of fixing things when something or somebody screwed up your system so you don't have a working terminal for that visual editor.</p> </blockquote> <p></p> <p><strong>DigitalOcean</strong> <a href="http://do.co/bsdnow" rel="nofollow" target="_blank">Digital Ocean Promo Link for BSD Now Listeners</a></p> <p></p> <h3><a href="https://vermaden.wordpress.com/2018/04/16/distributed-object-storage-with-minio-on-freebsd/" rel="nofollow" target="_blank">Distributed Object Storage with Minio on FreeBSD</a></h3> <blockquote> <p>Free and open source distributed object storage server compatible with Amazon S3 v2/v4 API. Offers data protection against hardware failures using erasure code and bitrot detection. Supports highly available distributed setup. Provides confidentiality, integrity and authenticity assurances for encrypted data with negligible performance overhead. Both server side and client side encryption are supported. Below is the image of example Minio setup.</p> </blockquote> <ul> <li><a href="https://vermaden.files.wordpress.com/2018/04/minio-architecture-diagram-distributed.jpg?w=960" rel="nofollow" target="_blank">Architecture Diagram </a></li> </ul> <p>The Minio identifies itself as the ZFS of Cloud Object Storage. This guide will show You how to setup highly available distributed Minio storage on the FreeBSD operating system with ZFS as backend for Minio data. For convenience we will use FreeBSD Jails operating system level virtualization.</p> <ul> <li>Setup</li> </ul> <blockquote> <p>The setup will assume that You have 3 datacenters and assumption that you have two datacenters in whose the most of the data must reside and that the third datacenter is used as a ‘quorum/witness’ role. Distributed Minio supports up to 16 nodes/drives total, so we may juggle with that number to balance data between desired datacenters. As we have 16 drives to allocate resources on 3 sites we will use 7 + 7 + 2 approach here. The datacenters where most of the data must reside have 7/16 ratio while the ‘quorum/witness’ datacenter have only 2/16 ratio. Thanks to built in Minio redundancy we may loose (turn off for example) any one of those machines and our object storage will still be available and ready to use for any purpose.</p> </blockquote> <ul> <li>Jails</li> </ul> <blockquote> <p>First we will create 3 jails for our proof of concept Minio setup, storage1 will have the ‘quorum/witness’ role while storage2 and storage3 will have the ‘data’ role. To distinguish commands I type on the host system and storageX Jail I use two different prompts, this way it should be obvious what command to execute and where.</p> </blockquote> <ul> <li>WeI know the FreeNAS people have been working on integrating this</li> </ul> <p></p> <h3><a href="https://kristaps.bsd.lv/kcgi/tutorial6.html" rel="nofollow" target="_blank">Best practises for pledge(2) security</a></h3> <blockquote> <p>Let's set the record straight for securing kcgi CGI and FastCGI applications with pledge(2). This is focussed on secure OpenBSD deployments.</p> </blockquote> <ul> <li>Theory</li> </ul> <blockquote> <p>Internally, kcgi makes considerable use of available security tools. But it's also designed to be invoked in a secure environment. We'll start with pledge(2), which has been around on OpenBSD since version 5.9. If you're reading this tutorial, you're probably on OpenBSD, and you probably have knowledge of pledge(2).</p> <p>How to begin? Read kcgi(3). It includes canonical information on which pledge(2) promises you'll need for each function in the library. This is just a tutorial—the manpage is canonical and overrides what you may read here.</p> <p>Next, assess the promises that your application needs. From kcgi(3), it's easy to see which promises we'll need to start. You'll need to augment this list with whichever tools you're also using. The general push is to start with the broadest set of required promises, then restrict as quickly as possible. Sometimes this can be done in a single pledge(2), but other times it takes a few.</p> </blockquote> <p></p> <h2>Beastie Bits</h2> <ul> <li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-April/014194.html" rel="nofollow" target="_blank">April's London *BSD meetup - notes</a></li> <li><a href="http://mailman.uk.freebsd.org/pipermail/ukfreebsd/2018-May/014198.html" rel="nofollow" target="_blank">May’s London *BSD Meetup: May 22nd </a></li> <li><a href="https://2018.eurobsdcon.org/call-for-papers/" rel="nofollow" target="_blank">Call for Papers for EuroBSDcon 2018</a></li> <li><a href="https://www.freebsdfoundation.org/journal/" rel="nofollow" target="_blank">FreeBSD Journal March/April Desktop/Laptop issue</a></li> <li><a href="https://lwn.net/Articles/752063/" rel="nofollow" target="_blank">LWN followup on the PostgreSQL fsync() issue</a></li> <li><a href="https://awards.acm.org/outstanding-contribution" rel="nofollow" target="_blank">The Association for Computing Machinery recognizes Steve Bourne for outstanding contributions</a></li> </ul> <p></p> <h2>Feedback/Questions</h2> <ul> <li>Ray - <a href="http://dpaste.com/1F8RX6H#wrap" rel="nofollow" target="_blank">Speaking at Conferences</a></li> <li>Casey - <a href="http://dpaste.com/364FTMM#wrap" rel="nofollow" target="_blank">Questions</a></li> <li>Jeremy - <a href="http://dpaste.com/3GWHP9N#wrap" rel="nofollow" target="_blank">zfs in the enterprise</a> <ul><li><a href="https://wiki.freebsd.org/HAST" rel="nofollow" target="_blank">HAST + ZFS</a></li></ul></li> <li>Lars - <a href="http://dpaste.com/1HDZFA3" rel="nofollow" target="_blank">Civil Infrastructure Platform use of *BSD</a></li> </ul> <p></p> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li> </ul>

Episode 246: Properly Coordinated Disclosure | BSD Now 246

How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more. Headlines Why computers suck and how learning from OpenBSD can make them marginally less horrible  How much better could things actually be if we abandoned the enterprise development model?  Next I will compare this enterprise development approach with non-enterprise development - projects such as OpenBSD, which do not hesitate to introduce ABI breaking changes to improve the codebase. One of the most commonly referred to pillars of the project's philosophy has long been its emphasis on clean functional code. Any code which makes it into OpenBSD is subject to ongoing aggressive audits for deprecated, or otherwise unmaintained code in order to reduce cruft and attack surface. Additionally the project creator, Theo de Raadt, and his team of core developers engage in ongoing development for proactive mitigations for various attack classes many of which are directly adopted by various multi-platform userland applications as well as the operating systems themselves (Windows, Linux, and the other BSDs). Frequently it is the case that introducing new features (not just deprecating old ones) introduces new incompatibilities against previously functional binaries compiled for OpenBSD.  To prevent the sort of kernel memory bloat that has plagued so many other operating systems for years, the project enforces a hard ceiling on the number of lines of code that can ever be in ring 0 at a given time. Current estimates guess the number of bugs per line of code in the Linux kernel are around 1 bug per every 10,000 lines of code. Think of this in the context of the scope creep seen in the Linux kernel (which if I recall correctly is currently at around 100,000,000 lines of code), as well as the Windows NT kernel (500,000,000 lines of code) and you quickly begin to understand how adding more and more functionality into the most privileged components of the operating system without first removing old components begins to add up in terms of the drastic difference seen between these systems in the number of zero day exploits caught in the wild respectively.  How Unix Works: Become a Better Software Engineer  Unix is beautiful. Allow me to paint some happy little trees for you. I’m not going to explain a bunch of commands – that’s boring, and there’s a million tutorials on the web doing that already. I’m going to leave you with the ability to reason about the system. Every fancy thing you want done is one google search away. But understanding why the solution does what you want is not the same. That’s what gives you real power, the power to not be afraid. And since it rhymes, it must be true.  News Roundup FreeBSD 12.1 Runs Refreshingly Well With AMD Ryzen Threadripper 3970X  For those of you interested in AMD's new Ryzen Threadripper 3960X/3970X processors with TRX40 motherboards for running FreeBSD, the experience in our initial testing has been surprisingly pleasant. In fact, it works out-of-the-box which one could argue is better than the current Linux support that needs the MCE workaround for booting. Here are some benchmarks of FreeBSD 12.1 on the Threadripper 3970X compared to Linux and Windows for this new HEDT platform. It was refreshing to see FreeBSD 12.1 booting and running just fine with the Ryzen Threadripper 3970X 32-core/64-thread processor from the ASUS ROG ZENITH II EXTREME motherboard and all core functionality working including the PCIe 4.0 NVMe SSD storage, onboard networking, etc. The system was running with 4 x 16GB DDR4-3600 memory, 1TB Corsair Force MP600 NVMe SSD, and Radeon RX 580 graphics. It was refreshing to see FreeBSD 12.1 running well with this high-end AMD Threadripper system considering Linux even needed a boot workaround. While the FreeBSD 12.1 experience was trouble-free with the ASUS TRX40 motherboard (ROG Zenith II Extreme) and AMD Ryzen Threadripper 3970X, DragonFlyBSD unfortunately was not. Both DragonFlyBSD 5.6.2 stable and the DragonFlyBSD daily development snapshot from last week were yielding a panic on boot. So with that, DragonFlyBSD wasn't tested for this Threadripper 3970X comparison but just FreeBSD 12.1. FreeBSD 12.1 on the Threadripper 3970X was benchmarked both with its default LLVM Clang 8.0.1 compiler and again with GCC 9.2 from ports for ruling out compiler differences. The FreeBSD 12.1 performance was compared to last week's Windows 10 vs. Linux benchmarks with the same system.  BSDCan 2020 CFP  BSDCan 2020 will be held 5-6 (Fri-Sat) June, 2020 in Ottawa, at the University of Ottawa. It will be preceded by two days of tutorials on 3-4 June (Wed-Thu). NOTE the change of month in 2020 back to June Also: do not miss out on the Goat BOF on Tuesday 2 June. We are now accepting proposals for talks.  The talks should be designed with a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.   See http://www.bsdcan.org/2020/   If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal. Possible topics include:   How we manage a giant installation with respect to handling spam. and/or sysadmin. and/or networking. Cool new stuff in BSD Tell us about your project which runs on BSD other topics (see next paragraph)   From the BSDCan website, the Archives section will allow you to review the wide variety of past BSDCan presentations as further examples. Both users and developers are encouraged to share their experiences.  HardenedBSD Infrastructure Goals  2019 has been an extremely productive year with regards to HardenedBSD's infrastructure. Several opportunities aligned themselves in such a way as to open a door for a near-complete rebuild with a vast expansion. The last few months especially have seen a major expansion of our infrastructure. We obtained a number of to-be-retired Dell R410 servers. The crash of our nightly build server provided the opportunity to deploy these R410 servers, doubling our build capacity. My available time to spend on HardenedBSD has decreased compared to this time last year. As part of rebuilding our infrastructure, I wanted to enable the community to be able to contribute. I'm structuring the work such that help is just a pull request away. Those in the HardenedBSD community who want to contribute to the infrastructure work can simply open a pull request. I'll review the code, and deploy it after a successful review. Users/contributors don't need access to our servers in order to improve them. My primary goal for the rest of 2019 and into 2020 is to become fully self-hosted, with the sole exception of email. I want to transition the source-of-truth git repos to our own infrastructure. We will still provide a read-only mirror on GitHub. As I develop this infrastructure, I'm doing so with human rights in mind. HardenedBSD is in a very unique position. In 2020, I plan to provide production Tor Onion Services for the various bits of our infrastructure. HardenedBSD will provide access to its various internal services to its developers and contributors. The entire development lifecycle, going from dev to prod, will be able to happen over Tor. Transparency will be key moving forward. Logs for the auto-sync script are now published directly to GitHub. Build logs will be, soon, too. Logs of all automated processes, and the code for those processes, will be tracked publicly via git. This will be especially crucial for development over Tor. Integrating Tor into our infrastructure so deeply increases risk and maintenance burden. However, I believe that through added transparency, we will be able to mitigate risk. Periodic audits will need to be performed and published. I hope to migrate HardenedBSD's site away from Drupal to a static site generator. We don't really need the dynamic capabilities Drupal gives us. The many security issues Drupal and PHP both bring also leave much to be desired. So, that's about it. I spent the last few months of 2019 laying the foundation for a successful 2020. I'm excited to see how the project grows.  Beastie Bits  FuryBSD - KDE plasma flavor now available DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud LPI is looking for BSD Specialist learning material writers ZFS sync/async + ZIL/SLOG, explained BSD-Licensed Combinatorics library/utility SSL client vs server certificates and bacula-fd MaxxDesktop planning to come to FreeBSD Project Page  Feedback/Questions  Tom - ZFS Mirror with different speeds Jeff - Knowledge is power Johnny - Episode 324 response to Jacob Pat - NYC*BUG meeting Jan Meeting Location   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv        Your browser does not support the HTML5 video tag.

<p>How learning OpenBSD makes computers suck a little less, How Unix works, FreeBSD 12.1 Runs Well on Ryzen Threadripper 3970X, BSDCan CFP, HardenedBSD Infrastructure Goals, and more.</p> <h2>Headlines</h2> <h3><a href="https://telegra.ph/Why-OpenBSD-is-marginally-less-horrible-12-05" rel="nofollow" target="_blank">Why computers suck and how learning from OpenBSD can make them marginally less horrible</a></h3> <blockquote> <p>How much better could things actually be if we abandoned the enterprise development model? </p> <p>Next I will compare this enterprise development approach with non-enterprise development - projects such as OpenBSD, which do not hesitate to introduce ABI breaking changes to improve the codebase.</p> <p>One of the most commonly referred to pillars of the project's philosophy has long been its emphasis on clean functional code. Any code which makes it into OpenBSD is subject to ongoing aggressive audits for deprecated, or otherwise unmaintained code in order to reduce cruft and attack surface. Additionally the project creator, Theo de Raadt, and his team of core developers engage in ongoing development for proactive mitigations for various attack classes many of which are directly adopted by various multi-platform userland applications as well as the operating systems themselves (Windows, Linux, and the other BSDs). Frequently it is the case that introducing new features (not just deprecating old ones) introduces new incompatibilities against previously functional binaries compiled for OpenBSD. </p> <p>To prevent the sort of kernel memory bloat that has plagued so many other operating systems for years, the project enforces a hard ceiling on the number of lines of code that can ever be in ring 0 at a given time. Current estimates guess the number of bugs per line of code in the Linux kernel are around 1 bug per every 10,000 lines of code. Think of this in the context of the scope creep seen in the Linux kernel (which if I recall correctly is currently at around 100,000,000 lines of code), as well as the Windows NT kernel (500,000,000 lines of code) and you quickly begin to understand how adding more and more functionality into the most privileged components of the operating system without first removing old components begins to add up in terms of the drastic difference seen between these systems in the number of zero day exploits caught in the wild respectively.</p> </blockquote> <h3><a href="https://neilkakkar.com/unix.html" rel="nofollow" target="_blank">How Unix Works: Become a Better Software Engineer</a></h3> <blockquote> <p>Unix is beautiful. Allow me to paint some happy little trees for you. I’m not going to explain a bunch of commands – that’s boring, and there’s a million tutorials on the web doing that already. I’m going to leave you with the ability to reason about the system.</p> <p>Every fancy thing you want done is one google search away.</p> <p>But understanding why the solution does what you want is not the same.</p> <p>That’s what gives you real power, the power to not be afraid.</p> <p>And since it rhymes, it must be true.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://www.phoronix.com/scan.php?page=article&amp;item=freebsd-amd-3970x&amp;num=1" rel="nofollow" target="_blank">FreeBSD 12.1 Runs Refreshingly Well With AMD Ryzen Threadripper 3970X</a></h3> <blockquote> <p>For those of you interested in AMD's new Ryzen Threadripper 3960X/3970X processors with TRX40 motherboards for running FreeBSD, the experience in our initial testing has been surprisingly pleasant. In fact, it works out-of-the-box which one could argue is better than the current Linux support that needs the MCE workaround for booting. Here are some benchmarks of FreeBSD 12.1 on the Threadripper 3970X compared to Linux and Windows for this new HEDT platform.</p> <p>It was refreshing to see FreeBSD 12.1 booting and running just fine with the Ryzen Threadripper 3970X 32-core/64-thread processor from the ASUS ROG ZENITH II EXTREME motherboard and all core functionality working including the PCIe 4.0 NVMe SSD storage, onboard networking, etc. The system was running with 4 x 16GB DDR4-3600 memory, 1TB Corsair Force MP600 NVMe SSD, and Radeon RX 580 graphics. It was refreshing to see FreeBSD 12.1 running well with this high-end AMD Threadripper system considering Linux even needed a boot workaround.</p> <p>While the FreeBSD 12.1 experience was trouble-free with the ASUS TRX40 motherboard (ROG Zenith II Extreme) and AMD Ryzen Threadripper 3970X, DragonFlyBSD unfortunately was not. Both DragonFlyBSD 5.6.2 stable and the DragonFlyBSD daily development snapshot from last week were yielding a panic on boot. So with that, DragonFlyBSD wasn't tested for this Threadripper 3970X comparison but just FreeBSD 12.1.</p> <p>FreeBSD 12.1 on the Threadripper 3970X was benchmarked both with its default LLVM Clang 8.0.1 compiler and again with GCC 9.2 from ports for ruling out compiler differences. The FreeBSD 12.1 performance was compared to last week's Windows 10 vs. Linux benchmarks with the same system.</p> </blockquote> <h3><a href="https://lists.bsdcan.org/pipermail/bsdcan-announce/2019-December/000180.html" rel="nofollow" target="_blank">BSDCan 2020 CFP</a></h3> <blockquote> <p>BSDCan 2020 will be held 5-6 (Fri-Sat) June, 2020 in Ottawa, at the University of Ottawa. It will be preceded by two days of tutorials on 3-4 June (Wed-Thu).</p> <p>NOTE the change of month in 2020 back to June Also: do not miss out on the Goat BOF on Tuesday 2 June.</p> <p>We are now accepting proposals for talks.  The talks should be designed with a very strong technical content bias. Proposals of a business development or marketing nature are not appropriate for this venue.</p> </blockquote> <ul> <li>See <a href="http://www.bsdcan.org/2020/" rel="nofollow" target="_blank">http://www.bsdcan.org/2020/</a></li> </ul> <blockquote> <p>If you are doing something interesting with a BSD operating system, please submit a proposal. Whether you are developing a very complex system using BSD as the foundation, or helping others and have a story to tell about how BSD played a role, we want to hear about your experience.  People using BSD as a platform for research are also encouraged to submit a proposal. Possible topics include:</p> </blockquote> <ul> <li>How we manage a giant installation with respect to handling spam.</li> <li>and/or sysadmin.</li> <li>and/or networking.</li> <li>Cool new stuff in BSD</li> <li>Tell us about your project which runs on BSD</li> <li>other topics (see next paragraph)</li> </ul> <blockquote> <p>From the BSDCan website, the Archives section will allow you to review the wide variety of past BSDCan presentations as further examples.</p> <p>Both users and developers are encouraged to share their experiences.</p> </blockquote> <h3><a href="https://github.com/lattera/articles/blob/master/hardenedbsd/2019-12-01_infrastructure/article.md" rel="nofollow" target="_blank">HardenedBSD Infrastructure Goals</a></h3> <blockquote> <p>2019 has been an extremely productive year with regards to HardenedBSD's infrastructure. Several opportunities aligned themselves in such a way as to open a door for a near-complete rebuild with a vast expansion.</p> <p>The last few months especially have seen a major expansion of our infrastructure. We obtained a number of to-be-retired Dell R410 servers. The crash of our nightly build server provided the opportunity to deploy these R410 servers, doubling our build capacity.</p> <p>My available time to spend on HardenedBSD has decreased compared to this time last year. As part of rebuilding our infrastructure, I wanted to enable the community to be able to contribute. I'm structuring the work such that help is just a pull request away. Those in the HardenedBSD community who want to contribute to the infrastructure work can simply open a pull request. I'll review the code, and deploy it after a successful review. Users/contributors don't need access to our servers in order to improve them.</p> <p>My primary goal for the rest of 2019 and into 2020 is to become fully self-hosted, with the sole exception of email. I want to transition the source-of-truth git repos to our own infrastructure. We will still provide a read-only mirror on GitHub.</p> <p>As I develop this infrastructure, I'm doing so with human rights in mind. HardenedBSD is in a very unique position. In 2020, I plan to provide production Tor Onion Services for the various bits of our infrastructure. HardenedBSD will provide access to its various internal services to its developers and contributors. The entire development lifecycle, going from dev to prod, will be able to happen over Tor.</p> <p>Transparency will be key moving forward. Logs for the auto-sync script are now published directly to GitHub. Build logs will be, soon, too. Logs of all automated processes, and the code for those processes, will be tracked publicly via git. This will be especially crucial for development over Tor.</p> <p>Integrating Tor into our infrastructure so deeply increases risk and maintenance burden. However, I believe that through added transparency, we will be able to mitigate risk. Periodic audits will need to be performed and published.</p> <p>I hope to migrate HardenedBSD's site away from Drupal to a static site generator. We don't really need the dynamic capabilities Drupal gives us. The many security issues Drupal and PHP both bring also leave much to be desired.</p> <p>So, that's about it. I spent the last few months of 2019 laying the foundation for a successful 2020. I'm excited to see how the project grows.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.furybsd.org/kde-plasma-flavor-now-available/" rel="nofollow" target="_blank">FuryBSD - KDE plasma flavor now available</a></li> <li><a href="http://lists.dragonflybsd.org/pipermail/commits/2019-November/719945.html" rel="nofollow" target="_blank">DragonFly - git: virtio - Fix LUN scan issue w/ Google Cloud</a></li> <li><a href="https://wiki.lpi.org/wiki/BSD_Specialist_Objectives_V1.0" rel="nofollow" target="_blank">LPI is looking for BSD Specialist learning material writers</a></li> <li><a href="https://jrs-s.net/2019/05/02/zfs-sync-async-zil-slog/" rel="nofollow" target="_blank">ZFS sync/async + ZIL/SLOG, explained</a></li> <li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-December/001921.html" rel="nofollow" target="_blank">BSD-Licensed Combinatorics library/utility</a></li> <li><a href="https://dan.langille.org/2019/11/29/ssl-client-vs-server-certificates-and-bacula-fd/" rel="nofollow" target="_blank">SSL client vs server certificates and bacula-fd</a></li> <li><a href="https://www.facebook.com/maxxdesktop/posts/2761326693888282" rel="nofollow" target="_blank">MaxxDesktop planning to come to FreeBSD</a> <a href="https://www.facebook.com/maxxdesktop/" rel="nofollow" target="_blank">Project Page</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Tom - <a href="http://dpaste.com/3ZGYNS3#wrap" rel="nofollow" target="_blank">ZFS Mirror with different speeds</a></li> <li>Jeff - <a href="http://dpaste.com/1H9QDCR#wrap" rel="nofollow" target="_blank">Knowledge is power</a></li> <li>Johnny - <a href="http://dpaste.com/1A7Q9EV" rel="nofollow" target="_blank">Episode 324 response to Jacob</a></li> <li>Pat - <a href="http://dpaste.com/0QPZ2GC" rel="nofollow" target="_blank">NYC*BUG meeting Jan Meeting Location</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li></ul>    <br>    Your browser does not support the HTML5 video tag.

331: Why Computers Suck

Introducing funlinkat(), an OpenBSD Router with AT&amp;T U-Verse, using NetBSD on a raspberry pi, ZFS encryption is still under development, Rump kernel servers and clients tutorial, Snort on OpenBSD 6.4, and more. Headlines Introducing funlinkat  It turns out, every file you have ever deleted on a unix machine was probably susceptible to a race condition   One of the first syscalls which was created in Unix-like systems is unlink. In FreeBSD this syscall is number 10 (source) and in Linux, the number is dependent on the architecture but for most of them is also the tenth syscall (source). This indicated that this is one of the primary syscalls. The unlink syscall is very simple and we provide one single path to the file that we want to remove.  The “removing file” process itself is very interesting so let’s spend a moment to understand the it. First, by removing the file we are removing a link from the directory to it. In Unix-like systems we can have many links to a single file (hard links). When we remove all links to the file, the file system will mark the blocks used by the file as free (a different file system will behave differently but let’s not jump into a second digression). This is why the process is called unlinking and not “removing file”. While we unlink the file two or three things will happen:  We will remove an entry in the directory with the filename. We will decrease a file reference count (in inode). If links go to zero - the file will be removed from the disk (again this doesn't mean that the blocks from the disk will be filled with zeros, though this may happen depending on the file system and configuration. However, in most cases this means that the file system will mark those blocks to as free and use them to write new data later  This mostly means that “removing file” from a directory is an operation on the directory and not on the file (inode) itself.  Another interesting subject is what happens if our system will perform only first or second step from the list. This depends on the file system and this is also something we will leave for another time.  The problem with the unlink and even unlinkat function is that we don’t have any guarantee of which file we really are unlinking. When you delete a file using its name, you have no guarantee that someone has not already deleted the file, or renamed it, and created a new file with the name you are about to delete.  We have some stats about the file that we want to unlink. We performed some tests. In the same time another process removed our file and recreated it. When we finally try to remove our file it is no longer the same file. It’s a classic race condition. Many programs will perform checks before trying to remove a file, to make sure it is the correct file, that you have the correct permissions etc. However this exposes the ‘Time-of-Check / Time-of-Use’ class of bugs. I check if the file I am about to remove is the one I created yesterday, it is, so I call unlink() on it. However, between when I checked the date on the file, and when I call unlink, I, some program I am running, might have updated the file. Or a malicious user might have put some other file at that name, so I would be the one who deleted it.  In Unix-like operating systems we can get a handle for our file called file - a descriptor. File descriptors guarantee us that all the operations that we will be performing on it are done on the same file (inode). Even if someone was to unlink a number of directories entries, the operating system will not free the structures behind the file descriptor, and we can detect the file that was removed by someone and recreated (or just unlinked). So, for example, we have an alternative functions fstat which allows us to get file status of the given descriptor  We already know that the file may have many links on the disk which point to the single inode. What happens when we open the file? Simplifying: kernel creates a memory representation of the inode (the inode itself is stored on the disk) called vnode. This single representation is used by all processes to refer the inode to the disk. If in a process we open the same file (inode) using different names (for example through hard links) all those files will be linked to the single vnode. That means that the pathname is not stored in the kernel.  This is basically the reason why we don’t have a funlink function so that instead of the path we are providing just the file descriptor to the file. If we performed the fdunlink syscall, the kernel wouldn’t know which directory entry you would like to remove. Another problem is more architectural: as we discussed earlier unlinking is really an operation on the directory not on the file (inode) itself, so using funlink(fd) may create some confusion because we are not removing the inode corresponding to the file descriptor, we are performing action on the directory which points to the file.  After some discussion we decided that the only sensible option for FreeBSD would be to create a funlinkat() function. This syscall would only performs additional sanitary checks if we are removing a directory entry which corresponds to the inode stored which refers to the file descriptor.  int funlinkat(int dfd, const char *path, int fd, int flags);  The API above will check if the path opened relative to the dfd points to the same vnode. Thanks to that we removed a race condition because all those sanitary checks are performed in the kernel mode while the file system is locked and there is no possibility to change it.  The fd parameter may be set to the FD_NONE value which will mean that the sanitary check should not be performed and funlinkat will behave just like unlinkat.  As you can notice I often refer to the unlink syscall but at the end the APIs looks like unlinkat syscall. It is true that the unlink syscall is very old and kind of deprecated. That said I referred to unlink because it’s just simpler. These days unlink simply uses the same code as unlinkat.    Using an OpenBSD Router with AT&amp;T U-Verse  I upgraded to AT&amp;T's U-verse Gigabit internet service in 2017 and it came with an Arris BGW-210 as the WiFi AP and router. The BGW-210 is not a terrible device, but I already had my own Airport Extreme APs wired throughout my house and an OpenBSD router configured with various things, so I had no use for this device. It's also a potentially-insecure device that I can't upgrade or fully disable remote control over.  Fully removing the BGW-210 is not possible as we'll see later, but it is possible to remove it from the routing path. This is how I did it with OpenBSD.  News Roundup How to use NetBSD on a Raspberry Pi  Do you have an old Raspberry Pi lying around gathering dust, maybe after a recent Pi upgrade? Are you curious about BSD Unix? If you answered "yes" to both of these questions, you'll be pleased to know that the first is the solution to the second, because you can run NetBSD, as far back as the very first release, on a Raspberry Pi.  BSD is the Berkley Software Distribution of Unix. In fact, it's the only open source Unix with direct lineage back to the original source code written by Dennis Ritchie and Ken Thompson at Bell Labs. Other modern versions are either proprietary (such as AIX and Solaris) or clever re-implementations (such as Minix and GNU/Linux). If you're used to Linux, you'll feel mostly right at home with BSD, but there are plenty of new commands and conventions to discover. If you're still relatively new to open source, trying BSD is a good way to experience a traditional Unix.  Admittedly, NetBSD isn't an operating system that's perfectly suited for the Pi. It's a minimal install compared to many Linux distributions designed specifically for the Pi, and not all components of recent Pi models are functional under NetBSD yet. However, it's arguably an ideal OS for the older Pi models, since it's lightweight and lovingly maintained. And if nothing else, it's a lot of fun for any die-hard Unix geek to experience another side of the POSIX world.  ZFS Encryption is still under development (as of March 2019)  One of the big upcoming features that a bunch of people are looking forward to in ZFS is natively encrypted filesystems. This is already in the main development tree of ZFS On Linux, will likely propagate to FreeBSD (since FreeBSD ZFS will be based on ZoL), and will make it to Illumos if the Illumos people want to pull it in. People are looking forward to native encryption so much, in fact, that some of them have started using it in ZFS On Linux already, using either the development tip or one of the 0.8.0 release candidate pre-releases (ZoL is up to 0.8.0-rc3 as of now). People either doing this or planning to do this show up on the ZoL mailing list every so often.  CFT for FreeBSD + ZoL   Tutorial On Rump Kernel Servers and Clients  The rump anykernel architecture allows to run highly componentized kernel code configurations in userspace processes. Coupled with the rump sysproxy facility it is possible to run loosely distributed client-server "mini-operating systems". Since there is minimum configuration and the bootstrap time is measured in milliseconds, these environments are very cheap to set up, use, and tear down on-demand.  This document acts as a tutorial on how to configure and use unmodified NetBSD kernel drivers as userspace services with utilities available from the NetBSD base system. As part of this, it presents various use cases. One uses the kernel cryptographic disk driver (cgd) to encrypt a partition. Another one demonstrates how to operate an FFS server for editing the contents of a file system even though your user account does not have privileges to use the host's mount() system call. Additionally, using a userspace TCP/IP server with an unmodified web browser is detailed.  Installing Snort on OpenBSD 6.4  As you may recall from previous posts, I am running an OpenBSD server on an APU2 air-cooled 3 Intel NIC box as my router/firewall for my secure home network.  Given that all of my Internet traffic flows through this box, I thought it would be a cool idea to run an Intrusion Detection System (IDS) on it.  Snort is the big hog of the open source world so I took a peek in the packages directory on one of the mirrors and lo and behold we have the latest &amp; greatest version of Snort available!  Thanks devs!!!  I did some quick Googling and didn’t find much “modern” howto help out there so, after some trial and error, I have it up and running.  I thought I’d give back in a small way and share a quickie howto for other Googlers out there who are looking for guidance.  Here’s hoping that my title is good enough “SEO” to get you here!   Beastie Bits  os108 AT&amp;T Archives: The UNIX Operating System httpd(8): Adapt to industry wide current best security practices Quotes From A Book That Bashes Unix OpenBSD QA wiki   Feedback/Questions  Malcolm - Laptop Experience : Dell XPS 13 DJ - Feedback Alex - GhostBSD and Wifi : FIXED    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>Introducing funlinkat(), an OpenBSD Router with AT&amp;T U-Verse, using NetBSD on a raspberry pi, ZFS encryption is still under development, Rump kernel servers and clients tutorial, Snort on OpenBSD 6.4, and more.</p> <h2>Headlines</h2> <h3><a href="https://oshogbo.vexillium.org/blog/63/" rel="nofollow" target="_blank">Introducing funlinkat</a></h3> <ul> <li>It turns out, every file you have ever deleted on a unix machine was probably susceptible to a race condition</li> </ul> <blockquote> <p>One of the first syscalls which was created in Unix-like systems is unlink. In FreeBSD this syscall is number 10 (source) and in Linux, the number is dependent on the architecture but for most of them is also the tenth syscall (source). This indicated that this is one of the primary syscalls. The unlink syscall is very simple and we provide one single path to the file that we want to remove.<br>  The “removing file” process itself is very interesting so let’s spend a moment to understand the it. First, by removing the file we are removing a link from the directory to it. In Unix-like systems we can have many links to a single file (hard links). When we remove all links to the file, the file system will mark the blocks used by the file as free (a different file system will behave differently but let’s not jump into a second digression). This is why the process is called unlinking and not “removing file”. While we unlink the file two or three things will happen:</p> <ul> <li>We will remove an entry in the directory with the filename.</li> <li>We will decrease a file reference count (in inode).</li> <li>If links go to zero - the file will be removed from the disk (again this doesn't mean that the blocks from the disk will be filled with zeros, though this may happen depending on the file system and configuration. However, in most cases this means that the file system will mark those blocks to as free and use them to write new data later<br>  This mostly means that “removing file” from a directory is an operation on the directory and not on the file (inode) itself.<br>  Another interesting subject is what happens if our system will perform only first or second step from the list. This depends on the file system and this is also something we will leave for another time.<br>  The problem with the unlink and even unlinkat function is that we don’t have any guarantee of which file we really are unlinking.<br><ul> <li>When you delete a file using its name, you have no guarantee that someone has not already deleted the file, or renamed it, and created a new file with the name you are about to delete.<br>  We have some stats about the file that we want to unlink. We performed some tests. In the same time another process removed our file and recreated it. When we finally try to remove our file it is no longer the same file. It’s a classic race condition.</li> <li>Many programs will perform checks before trying to remove a file, to make sure it is the correct file, that you have the correct permissions etc. However this exposes the ‘Time-of-Check / Time-of-Use’ class of bugs. I check if the file I am about to remove is the one I created yesterday, it is, so I call unlink() on it. However, between when I checked the date on the file, and when I call unlink, I, some program I am running, might have updated the file. Or a malicious user might have put some other file at that name, so I would be the one who deleted it.<br>  In Unix-like operating systems we can get a handle for our file called file - a descriptor. File descriptors guarantee us that all the operations that we will be performing on it are done on the same file (inode). Even if someone was to unlink a number of directories entries, the operating system will not free the structures behind the file descriptor, and we can detect the file that was removed by someone and recreated (or just unlinked). So, for example, we have an alternative functions fstat which allows us to get file status of the given descriptor<br>  We already know that the file may have many links on the disk which point to the single inode. What happens when we open the file? Simplifying: kernel creates a memory representation of the inode (the inode itself is stored on the disk) called vnode. This single representation is used by all processes to refer the inode to the disk. If in a process we open the same file (inode) using different names (for example through hard links) all those files will be linked to the single vnode. That means that the pathname is not stored in the kernel.<br>  This is basically the reason why we don’t have a funlink function so that instead of the path we are providing just the file descriptor to the file. If we performed the fdunlink syscall, the kernel wouldn’t know which directory entry you would like to remove. Another problem is more architectural: as we discussed earlier unlinking is really an operation on the directory not on the file (inode) itself, so using funlink(fd) may create some confusion because we are not removing the inode corresponding to the file descriptor, we are performing action on the directory which points to the file.<br>  After some discussion we decided that the only sensible option for FreeBSD would be to create a funlinkat() function. This syscall would only performs additional sanitary checks if we are removing a directory entry which corresponds to the inode stored which refers to the file descriptor.<br>  int funlinkat(int dfd, const char *path, int fd, int flags);<br>  The API above will check if the path opened relative to the dfd points to the same vnode. Thanks to that we removed a race condition because all those sanitary checks are performed in the kernel mode while the file system is locked and there is no possibility to change it.<br>  The fd parameter may be set to the FD_NONE value which will mean that the sanitary check should not be performed and funlinkat will behave just like unlinkat.<br>  As you can notice I often refer to the unlink syscall but at the end the APIs looks like unlinkat syscall. It is true that the unlink syscall is very old and kind of deprecated. That said I referred to unlink because it’s just simpler. These days unlink simply uses the same code as unlinkat.</li></ul> </li> </ul> </blockquote> <h3><a href="https://jcs.org/2019/03/21/uverse" rel="nofollow" target="_blank">Using an OpenBSD Router with AT&amp;T U-Verse</a></h3> <blockquote> <p>I upgraded to AT&amp;T's U-verse Gigabit internet service in 2017 and it came with an Arris BGW-210 as the WiFi AP and router. The BGW-210 is not a terrible device, but I already had my own Airport Extreme APs wired throughout my house and an OpenBSD router configured with various things, so I had no use for this device. It's also a potentially-insecure device that I can't upgrade or fully disable remote control over.<br>  Fully removing the BGW-210 is not possible as we'll see later, but it is possible to remove it from the routing path. This is how I did it with OpenBSD.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://opensource.com/article/19/3/netbsd-raspberry-pi" rel="nofollow" target="_blank">How to use NetBSD on a Raspberry Pi</a></h3> <blockquote> <p>Do you have an old Raspberry Pi lying around gathering dust, maybe after a recent Pi upgrade? Are you curious about BSD Unix? If you answered "yes" to both of these questions, you'll be pleased to know that the first is the solution to the second, because you can run NetBSD, as far back as the very first release, on a Raspberry Pi.<br>  BSD is the Berkley Software Distribution of Unix. In fact, it's the only open source Unix with direct lineage back to the original source code written by Dennis Ritchie and Ken Thompson at Bell Labs. Other modern versions are either proprietary (such as AIX and Solaris) or clever re-implementations (such as Minix and GNU/Linux). If you're used to Linux, you'll feel mostly right at home with BSD, but there are plenty of new commands and conventions to discover. If you're still relatively new to open source, trying BSD is a good way to experience a traditional Unix.<br>  Admittedly, NetBSD isn't an operating system that's perfectly suited for the Pi. It's a minimal install compared to many Linux distributions designed specifically for the Pi, and not all components of recent Pi models are functional under NetBSD yet. However, it's arguably an ideal OS for the older Pi models, since it's lightweight and lovingly maintained. And if nothing else, it's a lot of fun for any die-hard Unix geek to experience another side of the POSIX world.</p> </blockquote> <h3><a href="https://utcc.utoronto.ca/~cks/space/blog/linux/ZFSEncryptionNotReady" rel="nofollow" target="_blank">ZFS Encryption is still under development (as of March 2019)</a></h3> <blockquote> <p>One of the big upcoming features that a bunch of people are looking forward to in ZFS is natively encrypted filesystems. This is already in the main development tree of ZFS On Linux, will likely propagate to FreeBSD (since FreeBSD ZFS will be based on ZoL), and will make it to Illumos if the Illumos people want to pull it in. People are looking forward to native encryption so much, in fact, that some of them have started using it in ZFS On Linux already, using either the development tip or one of the 0.8.0 release candidate pre-releases (ZoL is up to 0.8.0-rc3 as of now). People either doing this or planning to do this show up on the ZoL mailing list every so often.</p> <ul> <li><a href="https://lists.freebsd.org/pipermail/freebsd-stable/2019-April/090915.html" rel="nofollow" target="_blank">CFT for FreeBSD + ZoL</a></li> </ul> </blockquote> <h3><a href="https://www.netbsd.org/docs/rump/sptut.html" rel="nofollow" target="_blank">Tutorial On Rump Kernel Servers and Clients</a></h3> <blockquote> <p>The rump anykernel architecture allows to run highly componentized kernel code configurations in userspace processes. Coupled with the rump sysproxy facility it is possible to run loosely distributed client-server "mini-operating systems". Since there is minimum configuration and the bootstrap time is measured in milliseconds, these environments are very cheap to set up, use, and tear down on-demand.<br>  This document acts as a tutorial on how to configure and use unmodified NetBSD kernel drivers as userspace services with utilities available from the NetBSD base system. As part of this, it presents various use cases. One uses the kernel cryptographic disk driver (cgd) to encrypt a partition. Another one demonstrates how to operate an FFS server for editing the contents of a file system even though your user account does not have privileges to use the host's mount() system call. Additionally, using a userspace TCP/IP server with an unmodified web browser is detailed.</p> </blockquote> <h3><a href="https://functionallyparanoid.com/2019/03/18/installing-snort-on-openbsd-6-4/" rel="nofollow" target="_blank">Installing Snort on OpenBSD 6.4</a></h3> <blockquote> <p>As you may recall from previous posts, I am running an OpenBSD server on an APU2 air-cooled 3 Intel NIC box as my router/firewall for my secure home network.  Given that all of my Internet traffic flows through this box, I thought it would be a cool idea to run an Intrusion Detection System (IDS) on it.  Snort is the big hog of the open source world so I took a peek in the packages directory on one of the mirrors and lo and behold we have the latest &amp; greatest version of Snort available!  Thanks devs!!!<br>  I did some quick Googling and didn’t find much “modern” howto help out there so, after some trial and error, I have it up and running.  I thought I’d give back in a small way and share a quickie howto for other Googlers out there who are looking for guidance.  Here’s hoping that my title is good enough “SEO” to get you here! </p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="https://os108.org/" rel="nofollow" target="_blank">os108</a></li> <li><a href="https://www.youtube.com/watch?v=tc4ROCJYbm0&amp;feature=youtu.be" rel="nofollow" target="_blank">AT&amp;T Archives: The UNIX Operating System</a></li> <li><a href="https://marc.info/?l=openbsd-tech&amp;m=155407864604288&amp;w=2" rel="nofollow" target="_blank">httpd(8): Adapt to industry wide current best security practices</a></li> <li><a href="https://codesmithdev.com/quotes-from-a-book-that-bashes-unix/" rel="nofollow" target="_blank">Quotes From A Book That Bashes Unix</a></li> <li><a href="https://github.com/ligurio/openbsd-tests/wiki" rel="nofollow" target="_blank">OpenBSD QA wiki</a></li> </ul> <p></p> <h2>Feedback/Questions</h2> <ul> <li>Malcolm - <a href="http://dpaste.com/1AFFTNJ" rel="nofollow" target="_blank">Laptop Experience : Dell XPS 13</a></li> <li>DJ - <a href="http://dpaste.com/0V74SZC#wrap" rel="nofollow" target="_blank">Feedback</a></li> <li>Alex - <a href="http://dpaste.com/1WVV1W7" rel="nofollow" target="_blank">GhostBSD and Wifi : FIXED</a></li> </ul> <p></p> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li> </ul> <p></p>    <br>    Your browser does not support the HTML5 video tag.

295: Fun with funlinkat()

Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more. Headlines Authentication vulnerabilities in OpenBSD  We discovered an authentication-bypass vulnerability in OpenBSD's authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms. From the manual page of login.conf:   OpenBSD uses BSD Authentication, which is made up of a variety of authentication styles.  The authentication styles currently provided are:          passwd     Request a password and check it against the password in the master.passwd file.  See login_passwd(8).          skey       Send a challenge and request a response, checking it with S/Key (tm) authentication.  See login_skey(8).          yubikey    Authenticate using a Yubico YubiKey token.  See login_yubikey(8).          For any given style, the program /usr/libexec/auth/login_style is used to          perform the authentication.  The synopsis of this program is:          /usr/libexec/auth/login_style [-v name=value] [-s service] username class   This is the first piece of the puzzle: if an attacker specifies a username of the form "-option", they can influence the behavior of the authentication program in unexpected ways.    login_passwd [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class] The service argument specifies which protocol to use with the invoking program.  The allowed protocols are login, challenge, and response.  (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based).    This is the second piece of the puzzle: if an attacker specifies the username "-schallenge" (or "-schallenge:passwd" to force a passwd-style authentication), then the authentication is automatically successful and therefore bypassed. Case study: smtpd Case study: ldapd Case study: radiusd Case study: sshd Acknowledgments: We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. We also thank MITRE's CVE Assignment Team.  First release candidate for NetBSD 9.0 available!  Since the start of the release process four months ago a lot of improvements went into the branch - more than 500 pullups were processed! This includes usbnet (a common framework for usb ethernet drivers), aarch64 stability enhancements and lots of new hardware support, installer/sysinst fixes and changes to the NVMM (hardware virtualization) interface. We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year). Here are a few highlights of the new release:  Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady" compliant machines (SBBR+SBSA) Enhanced hardware support for Armv7-A Updated GPU drivers (e.g. support for Intel Kabylake) Enhanced virtualization support Support for hardware-accelerated virtualization (NVMM) Support for Performance Monitoring Counters Support for Kernel ASLR Support several kernel sanitizers (KLEAK, KASAN, KUBSAN) Support for userland sanitizers Audit of the network stack Many improvements in NPF Updated ZFS Reworked error handling and NCQ support in the SATA subsystem Support a common framework for USB Ethernet drivers (usbnet)  More information on the RC can be found on the NetBSD 9 release page  News Roundup Running FreeNAS on a Digitalocean droplet  ZFS is awesome. FreeBSD even more so. FreeNAS is the battle-tested, enterprise-ready-yet-home-user-friendly software defined storage solution which is cooler then deep space, based on FreeBSD and makes heavy use of ZFS. This is what I (and soooooo many others) use for just about any storage-related task. I can go on and on and on about what makes it great, but if you're here, reading this, you probably know all that already and we can skip ahead. I've needed an offsite FreeNAS setup to replicate things to, to run some things, to do some stuff, basically, my privately-owned, tightly-controlled NAS appliance in the cloud, one I control from top to bottom and with support for whatever crazy thing I'm trying to do. Since I'm using DigitalOcean as my main VPS provider, it seemed logical to run FreeNAS there, however, you can't. While DO supports many many distos and pre-setup applications (e.g OpenVPN), FreeNAS isn't a supported feature, at least not in the traditional way :) Before we begin, here's the gist of what we're going to do:   Base of a FreeBSD droplet, we'll re-image our boot block device with FreeNAS iso. We'll then install FreeNAS on the second block device. Once done we're going to do the ol' switcheroo: we're going to re-image our original boot block device using the now FreeNAS-installed second block device.    Part 1: re-image our boot block device to boot FreeNAS install media. Part 2: Install FreeNAS on the second block-device Part 3: Re-image the boot block device using the FreeNAS-installed block device  NomadBSD 1.3 is now available  From the release notes:   The base system has been changed to FreeBSD 12.1-RELEASE-p1  Due to a deadlock problem, FreeBSD's unionfs has been replaced by unionfs-fuse  The GPT layout has been changed to MBR. This prevents problems with Lenovo  systems that refuse to boot from GPT if "lenovofix" is not set, and systems that  hang on boot if "lenovofix" is set.  Support for ZFS installations has been added to the NomadBSD installer.  The rc-script for setting up the network interfaces has been fixed and improved.  Support for setting the country code for the wlan device has been added.  Auto configuration for running in VirtualBox has been added.  A check for the default display has been added to the graphics configuration scripts. This fixes problems where users with Optimus have their NVIDIA card disabled, and use the integrated graphics chip instead.  NVIDIA driver version 440 has been added.  nomadbsd-dmconfig, a Qt tool for selecting the display manager theme, setting the default user and autologin has been added.  nomadbsd-adduser, a Qt tool for added preconfigured user accounts to the system has been added.  Martin Orszulik added Czech translations to the setup and installation wizard.  The NomadBSD logo, designed by Ian Grindley, has been changed.  Support for localized error messages has been added.  Support for localizing the password prompts has been added.  Some templates for starting other DEs have been added to ~/.xinitrc.  The interfaces of nomadbsd-setup-gui and nomadbsd-install-gui have been improved.  A script that helps users to configure a multihead systems has been added.  The Xorg driver for newer Intel GPUs has been changed from "intel" to "modesetting".  /proc has been added to /etc/fstab  A D-Bus session issue has been fixed which prevented thunar from accessing  samba shares.  DSBBg which allows users to change and manage wallpapers has been added.  The latest version of update_obmenu now supports auto-updating the Openbox menu. Manually updating the Openbox menu after packet (de)installation is therefore no longer needed. Support for multiple keyboard layouts has been added.  www/palemoon has been removed.  mail/thunderbird has been removed.  audio/audacity has been added.  deskutils/orage has been added.  the password manager fpm2 has been replaced by KeePassXC  mail/sylpheed has been replaced by mail/claws-mail  multimedia/simplescreenrecorder has been added.  DSBMC has been changed to DSBMC-Qt  Many small improvements and bug fixes.  At e2k19 nobody can hear you scream  After 2 years it was once again time to pack skis and snowshoes, put a satellite dish onto a sledge and hike through the snowy rockies to the Elk Lakes hut. I did not really have much of a plan what I wanted to work on but there were a few things I wanted to look into. One of them was rpki-client and the fact that it was so incredibly slow. Since Bob beck@ was around I started to ask him innocent X509 questions ... as if there are innocent X509 questions! Mainly about the abuse of the X509_STORE in rpki-client. Pretty soon it was clear that rpki-client did it all wrong and most of the X509 verification had to be rewritten. Instead of only storing the root certificates in the store and passing the intermediate certs as a chain to the verification function rpki-client threw everything into it. The X509_STORE is just not built for such an abuse and so it was no wonder that this was slow. Lucky me I pulled benno@ with me into this dark hole of libcrypto code. He managed to build up an initial diff to pass the chains as a STACK_OF(X509) and together we managed to get it working. A big thanks goes to ingo@ who documented most of the functions we had to use. Have a look at STACK_OF(3) and sk_pop_free(3) to understand why benno@ and I slowly turned crazy. Our next challenge was to only load the necessary certificate revocation list into the X509_STORE_CTX. While doing those changes it became obvious that some of the data structures needed better lookup functions. Looking up certificates was done using a linear lookup and so we replaced the internal certificate and CRL tables with RB trees for fast lookups. deraadt@ also joined the rpki-client commit fest and changed the output code to use rename(2) so that files are replaced in an atomic operation. Thanks to this rpki-client can now be safely run from cron (there is an example in the default crontab). I did not plan to spend most of my week hacking on rpki-client but in the end I'm happy that I did and the result is fairly impressive. Working with libcrypto code and especially X509 was less than pleasant. Our screams of agony died away in the snowy rocky mountains and made Bob deep dive into UVM with a smile since he knew that benno@ and I had it worse. In case you wonder thanks to all changes at e2k19 rpki-client improved from over 20min run time to validate all VRPS to roughly 1min to do the same job. A factor 20 improvement! Thanks to Theo, Bob and Howie to make this possible. To all the cooks for the great food and to Xplornet for providing us with Internet at the hut.  Beastie Bits  FOSDEM 2020 BSD Devroom schedule Easy Minecraft Server on FreeBSD Howto stats(3) framework in the TCP stack 4017 days of uptime sysget - A front-end for every package manager PlayOnBSD’s Cross-BSD Shopping Guide  Feedback/Questions  Pat asks about the proper disk drive type for ZFS Brad asks about a ZFS rosetta stone   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv               Your browser does not support the HTML5 video tag. Special Guest: Mariusz Zaborski.

<p>Authentication Vulnerabilities in OpenBSD, NetBSD 9.0 RC1 is available, Running FreeNAS on a DigitalOcean droplet, NomadBSD 1.3 is here, at e2k19 nobody can hear you scream, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.openwall.com/lists/oss-security/2019/12/04/5" rel="nofollow" target="_blank">Authentication vulnerabilities in OpenBSD</a></h3> <ul> <li>We discovered an authentication-bypass vulnerability in OpenBSD's authentication system: this vulnerability is remotely exploitable in smtpd, ldapd, and radiusd, but its real-world impact should be studied on a case-by-case basis. For example, sshd is not exploitable thanks to its defense-in-depth mechanisms.</li> <li>From the manual page of login.conf:</li> </ul> <blockquote> <p>OpenBSD uses BSD Authentication, which is made up of a variety of authentication styles.  The authentication styles currently provided are:<br/>          passwd     Request a password and check it against the password in the master.passwd file.  See login_passwd(8).<br/>          skey       Send a challenge and request a response, checking it with S/Key (tm) authentication.  See login_skey(8).<br/>          yubikey    Authenticate using a Yubico YubiKey token.  See login_yubikey(8).<br/>          For any given style, the program /usr/libexec/auth/login_style is used to<br/>          perform the authentication.  The synopsis of this program is:<br/>          /usr/libexec/auth/login_style [-v name=value] [-s service] username class</p> </blockquote> <ul> <li>This is the first piece of the puzzle: if an attacker specifies a username of the form "-option", they can influence the behavior of the authentication program in unexpected ways.</li> </ul> <blockquote> <code> login_passwd [-s service] [-v wheel=yes|no] [-v lastchance=yes|no] user [class] The service argument specifies which protocol to use with the invoking program.  The allowed protocols are login, challenge, and response.  (The challenge protocol is silently ignored but will report success as passwd-style authentication is not challenge-response based). </code> </blockquote> <ul> <li>This is the second piece of the puzzle: if an attacker specifies the username "-schallenge" (or "-schallenge:passwd" to force a passwd-style authentication), then the authentication is automatically successful and therefore bypassed.</li> <li>Case study: smtpd</li> <li>Case study: ldapd</li> <li>Case study: radiusd</li> <li>Case study: sshd</li> <li>Acknowledgments: We thank Theo de Raadt and the OpenBSD developers for their incredibly quick response: they published patches for these vulnerabilities less than 40 hours after our initial contact. We also thank MITRE's CVE Assignment Team.</li> </ul> <h3><a href="https://blog.netbsd.org/tnf/entry/first_release_candidate_for_netbsd" rel="nofollow" target="_blank">First release candidate for NetBSD 9.0 available!</a></h3> <ul> <li>Since the start of the release process four months ago a lot of improvements went into the branch - more than 500 pullups were processed!</li> <li>This includes usbnet (a common framework for usb ethernet drivers), aarch64 stability enhancements and lots of new hardware support, installer/sysinst fixes and changes to the NVMM (hardware virtualization) interface.</li> <li>We hope this will lead to the best NetBSD release ever (only to be topped by NetBSD 10 next year).</li> <li><p>Here are a few highlights of the new release:</p> <blockquote> <p>Support for Arm AArch64 (64-bit Armv8-A) machines, including "Arm ServerReady"<br/> compliant machines (SBBR+SBSA)<br/> Enhanced hardware support for Armv7-A<br/> Updated GPU drivers (e.g. support for Intel Kabylake)<br/> Enhanced virtualization support<br/> Support for hardware-accelerated virtualization (NVMM)<br/> Support for Performance Monitoring Counters<br/> Support for Kernel ASLR<br/> Support several kernel sanitizers (KLEAK, KASAN, KUBSAN)<br/> Support for userland sanitizers<br/> Audit of the network stack<br/> Many improvements in NPF<br/> Updated ZFS<br/> Reworked error handling and NCQ support in the SATA subsystem<br/> Support a common framework for USB Ethernet drivers (usbnet)</p> </blockquote></li> <li><p>More information on the RC can be found on the <a href="https://www.netbsd.org/releases/formal-9/NetBSD-9.0.html" rel="nofollow" target="_blank">NetBSD 9 release page</a></p></li> </ul> <h2>News Roundup</h2> <h3><a href="https://www.shlomimarco.com/post/running-freenas-on-a-digitalocean-droplet" rel="nofollow" target="_blank">Running FreeNAS on a Digitalocean droplet</a></h3> <ul> <li>ZFS is awesome. FreeBSD even more so. FreeNAS is the battle-tested, enterprise-ready-yet-home-user-friendly software defined storage solution which is cooler then deep space, based on FreeBSD and makes heavy use of ZFS. This is what I (and soooooo many others) use for just about any storage-related task. I can go on and on and on about what makes it great, but if you're here, reading this, you probably know all that already and we can skip ahead.</li> <li>I've needed an offsite FreeNAS setup to replicate things to, to run some things, to do some stuff, basically, my privately-owned, tightly-controlled NAS appliance in the cloud, one I control from top to bottom and with support for whatever crazy thing I'm trying to do. Since I'm using DigitalOcean as my main VPS provider, it seemed logical to run FreeNAS there, however, you can't. While DO supports many many distos and pre-setup applications (e.g OpenVPN), FreeNAS isn't a supported feature, at least not in the traditional way :)</li> <li>Before we begin, here's the gist of what we're going to do:</li> </ul> <blockquote> <p>Base of a FreeBSD droplet, we'll re-image our boot block device with FreeNAS iso. We'll then install FreeNAS on the second block device. Once done we're going to do the ol' switcheroo: we're going to re-image our original boot block device using the now FreeNAS-installed second block device. </p> </blockquote> <ul> <li>Part 1: re-image our boot block device to boot FreeNAS install media.</li> <li>Part 2: Install FreeNAS on the second block-device</li> <li>Part 3: Re-image the boot block device using the FreeNAS-installed block device</li> </ul> <h3><a href="https://nomadbsd.org/" rel="nofollow" target="_blank">NomadBSD 1.3 is now available</a></h3> <ul> <li>From the release notes:</li> </ul> <blockquote> <p>The base system has been changed to FreeBSD 12.1-RELEASE-p1<br/>  Due to a deadlock problem, FreeBSD's unionfs has been replaced by unionfs-fuse<br/>  The GPT layout has been changed to MBR. This prevents problems with Lenovo<br/>  systems that refuse to boot from GPT if "lenovofix" is not set, and systems that<br/>  hang on boot if "lenovofix" is set.<br/>  Support for ZFS installations has been added to the NomadBSD installer.<br/>  The rc-script for setting up the network interfaces has been fixed and improved.<br/>  Support for setting the country code for the wlan device has been added.<br/>  Auto configuration for running in VirtualBox has been added.<br/>  A check for the default display has been added to the graphics configuration scripts. This fixes problems where users with Optimus have their NVIDIA card disabled, and use the integrated graphics chip instead.<br/>  NVIDIA driver version 440 has been added.<br/>  nomadbsd-dmconfig, a Qt tool for selecting the display manager theme, setting the<br/> default user and autologin has been added.<br/>  nomadbsd-adduser, a Qt tool for added preconfigured user accounts to the system has been added.<br/>  Martin Orszulik added Czech translations to the setup and installation wizard.<br/>  The NomadBSD logo, designed by Ian Grindley, has been changed.<br/>  Support for localized error messages has been added.<br/>  Support for localizing the password prompts has been added.<br/>  Some templates for starting other DEs have been added to ~/.xinitrc.<br/>  The interfaces of nomadbsd-setup-gui and nomadbsd-install-gui have been improved.<br/>  A script that helps users to configure a multihead systems has been added.<br/>  The Xorg driver for newer Intel GPUs has been changed from "intel" to "modesetting".<br/>  /proc has been added to /etc/fstab<br/>  A D-Bus session issue has been fixed which prevented thunar from accessing  samba shares.<br/>  DSBBg which allows users to change and manage wallpapers has been added.<br/>  The latest version of update_obmenu now supports auto-updating the Openbox menu. Manually updating the Openbox menu after packet (de)installation is therefore no longer needed.</p> <p>Support for multiple keyboard layouts has been added.<br/>  www/palemoon has been removed.<br/>  mail/thunderbird has been removed.<br/>  audio/audacity has been added.<br/>  deskutils/orage has been added.<br/>  the password manager fpm2 has been replaced by KeePassXC<br/>  mail/sylpheed has been replaced by mail/claws-mail<br/>  multimedia/simplescreenrecorder has been added.<br/>  DSBMC has been changed to DSBMC-Qt<br/>  Many small improvements and bug fixes.</p> </blockquote> <h3><a href="https://undeadly.org/cgi?action=article;sid=20191204170908" rel="nofollow" target="_blank">At e2k19 nobody can hear you scream</a></h3> <ul> <li>After 2 years it was once again time to pack skis and snowshoes, put a satellite dish onto a sledge and hike through the snowy rockies to the Elk Lakes hut.</li> <li>I did not really have much of a plan what I wanted to work on but there were a few things I wanted to look into. One of them was rpki-client and the fact that it was so incredibly slow. Since Bob beck@ was around I started to ask him innocent X509 questions ... as if there are innocent X509 questions! Mainly about the abuse of the X509_STORE in rpki-client. Pretty soon it was clear that rpki-client did it all wrong and most of the X509 verification had to be rewritten. Instead of only storing the root certificates in the store and passing the intermediate certs as a chain to the verification function rpki-client threw everything into it. The X509_STORE is just not built for such an abuse and so it was no wonder that this was slow.</li> <li>Lucky me I pulled benno@ with me into this dark hole of libcrypto code. He managed to build up an initial diff to pass the chains as a STACK_OF(X509) and together we managed to get it working. A big thanks goes to ingo@ who documented most of the functions we had to use. Have a look at STACK_OF(3) and sk_pop_free(3) to understand why benno@ and I slowly turned crazy.</li> <li>Our next challenge was to only load the necessary certificate revocation list into the X509_STORE_CTX. While doing those changes it became obvious that some of the data structures needed better lookup functions. Looking up certificates was done using a linear lookup and so we replaced the internal certificate and CRL tables with RB trees for fast lookups. deraadt@ also joined the rpki-client commit fest and changed the output code to use rename(2) so that files are replaced in an atomic operation. Thanks to this rpki-client can now be safely run from cron (there is an example in the default crontab).</li> <li>I did not plan to spend most of my week hacking on rpki-client but in the end I'm happy that I did and the result is fairly impressive. Working with libcrypto code and especially X509 was less than pleasant. Our screams of agony died away in the snowy rocky mountains and made Bob deep dive into UVM with a smile since he knew that benno@ and I had it worse.</li> <li>In case you wonder thanks to all changes at e2k19 rpki-client improved from over 20min run time to validate all VRPS to roughly 1min to do the same job. A factor 20 improvement!</li> <li>Thanks to Theo, Bob and Howie to make this possible. To all the cooks for the great food and to Xplornet for providing us with Internet at the hut.</li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://fosdem.org/2020/schedule/track/bsd/" rel="nofollow" target="_blank">FOSDEM 2020 BSD Devroom schedule</a></li> <li><a href="https://www.freebsdfoundation.org/freebsd/how-to-guides/easy-minecraft-server-on-freebsd/" rel="nofollow" target="_blank">Easy Minecraft Server on FreeBSD Howto</a></li> <li><a href="https://svnweb.freebsd.org/base?view=revision&amp;revision=355304" rel="nofollow" target="_blank">stats(3) framework in the TCP stack</a></li> <li><a href="https://twitter.com/EdwinKremer/status/1203071684535889921" rel="nofollow" target="_blank">4017 days of uptime</a></li> <li><a href="https://github.com/emilengler/sysget" rel="nofollow" target="_blank">sysget - A front-end for every package manager</a></li> <li><a href="https://www.playonbsd.com/shopping_guide/" rel="nofollow" target="_blank">PlayOnBSD’s Cross-BSD Shopping Guide</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li><a href="http://dpaste.com/2FDN26X#wrap" rel="nofollow" target="_blank">Pat asks about the proper disk drive type for ZFS</a></li> <li><a href="http://dpaste.com/2X8PBMC#wrap" rel="nofollow" target="_blank">Brad asks about a ZFS rosetta stone</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li> </ul>              Your browser does not support the HTML5 video tag. <p>Special Guest: Mariusz Zaborski.</p>

330: Happy Holidays, All(an)

DragonFlyBSD's kernel optimizations pay off, differences between OpenBSD and Linux, NetBSD 2019 Google Summer of Code project list, Reducing that contention, fnaify 1.3 released, vmctl(8): CLI syntax changes, and things that Linux distributions should not do when packaging. Headlines DragonFlyBSD's Kernel Optimizations Are Paying Off  DragonFlyBSD lead developer Matthew Dillon has been working on a big VM rework in the name of performance and other kernel improvements recently. Here is a look at how those DragonFlyBSD 5.5-DEVELOPMENT improvements are paying off compared to DragonFlyBSD 5.4 as well as FreeBSD 12 and five Linux distribution releases. With Dillon using an AMD Ryzen Threadripper system, we used that too for this round of BSD vs. Linux performance benchmarks. The work by Dillon on the VM overhaul and other changes (including more HAMMER2 file-system work) will ultimately culminate with the DragonFlyBSD 5.6 release (well, unless he opts for DragonFlyBSD 6.0 or so). These are benchmarks of the latest DragonFlyBSD 5.5-DEVELOPMENT daily ISO as of this week benchmarked across DragonFlyBSD 5.4.3 stable, FreeBSD 12.0, Ubuntu 19.04, Red Hat Enterprise Linux 8.0, Debian 9.9, Debian Buster, and CentOS 7 1810 as a wide variety of reference points both from newer and older Linux distributions. (As for no Clear Linux reference point for a speedy reference point, it currently has a regression with AMD + Samsung NVMe SSD support on some hardware, including this box, prohibiting the drive from coming up due to a presumed power management issue that is still being resolved.) With Matthew Dillon doing much of his development on an AMD Ryzen Threadripper system after he last year proclaimed the greatness of these AMD HEDT CPUs, for this round of testing I also used a Ryzen Threadripper 2990WX with 32 cores / 64 threads. Tests of other AMD/Intel hardware with DragonFlyBSD will come as the next stable release is near and all of the kernel work has settled down. For now it's mostly entertaining our own curiosity how well these DragonFlyBSD optimizations are paying off and how it's increasing the competition against FreeBSD 12 and Linux distributions.  What are the differences between OpenBSD and Linux?  Maybe you have been reading recently about the release of OpenBSD 6.5 and wonder, "What are the differences between Linux and OpenBSD?" I've also been there at some point in the past and these are my conclusions. They also apply, to some extent, to other BSDs. However, an important disclaimer applies to this article. This list is aimed at people who are used to Linux and are curious about OpenBSD. It is written to highlight the most important changes from their perspective, not the absolute most important changes from a technical standpoint. Please bear with me.   A terminal is a terminal is a terminal Practical differences Security and system administration Why philosophical differences matter So what do I choose? How to try OpenBSD ***  News Roundup NetBSD 2019 Google Summer of Code  We are very happy to announce The NetBSD Foundation Google Summer of Code 2019 projects:   Akul Abhilash Pillai - Adapting TriforceAFL for NetBSD kernel fuzzing Manikishan Ghantasala - Add KNF (NetBSD style) clang-format configuration Siddharth Muralee - Enhancing Syzkaller support for NetBSD Surya P - Implementation of COMPAT_LINUX and COMPAT_NETBSD32 DRM ioctls support for NetBSD kernel Jason High - Incorporation of Argon2 Password Hashing Algorithm into NetBSD Saurav Prakash - Porting NetBSD to HummingBoard Pulse Naveen Narayanan - Porting WINE to amd64 architecture on NetBSD   The communiting bonding period - where students get in touch with mentors and community - started yesterday. The coding period will start from May 27 until August 19. Please welcome all our students and a big good luck to students and mentors! A big thank to Google and The NetBSD Foundation organization mentors and administrators! Looking forward to a great Google Summer of Code!  Reducing that contention  The opening keynote at EuroBSDCon 2016 predicted the future 10 years of BSDs. Amongst all the funny previsions, gnn@FreeBSD said that by 2026 OpenBSD will have its first implementation of SMP. Almost 3 years after this talk, that sounds like a plausible forecast... Why? Where are we? What can we do? Let's dive into the issue!   State of affairs   Most of OpenBSD's kernel still runs under a single lock, ze KERNEL_LOCK(). That includes most of the syscalls, most of the interrupt handlers and most of the fault handlers. Most of them, not all of them. Meaning we have collected &amp; fixed bugs while setting up infrastructures and examples. Now this lock remains the principal responsible for the spin % you can observe in top(1) and systat(1). I believe that we opted for a difficult hike when we decided to start removing this lock from the bottom. As a result many SCSI &amp; Network interrupt handlers as well as all Audio &amp; USB ones can be executed without big lock. On the other hand very few syscalls are already or almost ready to be unlocked, as we incorrectly say. This explains why basic primitives like tsleep(9), csignal() and selwakeup() are only receiving attention now that the top of the Network Stack is running (mostly) without big lock.   Next steps   In the past years, most of our efforts have been invested into the Network Stack. As I already mentioned it should be ready to be parallelized. However think we should now concentrate on removing the KERNEL_LOCK(), even if the code paths aren't performance critical.    See the Article for the rest of the post  fnaify 1.3 released - more games are "fnaify &amp; run" now  This release finally addresses some of the problems that prevent simple running of several games. This happens for example when an old FNA.dll library comes with the games that doesn't match the API of our native libraries like SDL2, OpenAL, or MojoShader anymore. Some of those cases can be fixed by simply dropping in a newer FNA.dll. fnaify now asks if FNA 17.12 should be automatically added if a known incompatible FNA version is found. You simply answer yes or no.  Another blocker happens when the game expects to check the SteamAPI - either from a running Steam process, or a bundled steam_api library. OpenBSD 6.5-current now has steamworks-nosteam in ports, a stub library for Steamworks.NET that prevents games from crashing simply because an API function isn't found. The repo is here. fnaify now finds this library in /usr/local/share/steamstubs and uses it instead of the bundled (full) Steamworks.NET.dll. This may help with any games that use this layer to interact with the SteamAPI, mostly those that can only be obtained via Steam.   vmctl(8): command line syntax changed  The order of the arguments in the create, start, and stop commands of vmctl(8) has been changed to match a commonly expected style. Manual usage or scripting with vmctl must be adjusted to use the new syntax.  For example, the old syntax looked like this:  # vmctl create disk.qcow2 -s 50G  The new syntax specifies the command options before the argument:  # vmctl create -s 50G disk.qcow2 Something that Linux distributions should not do when packaging things  Right now I am a bit unhappy at Fedora for a specific packaging situation, so let me tell you a little story of what I, as a system administrator, would really like distributions to not do. For reasons beyond the scope of this blog entry, I run a Prometheus and Grafana setup on both my home and office Fedora Linux machines (among other things, it gives me a place to test out various things involving them). When I set this up, I used the official upstream versions of both, because I needed to match what we are running (or would soon be). Recently, Fedora decided to package Grafana themselves (as a RPM), and they called this RPM package 'grafana'. Since the two different packages are different versions of the same thing as far as package management tools are concerned, Fedora basically took over the 'grafana' package name from Grafana. This caused my systems to offer to upgrade me from the Grafana.com 'grafana-6.1.5-1' package to the Fedora 'grafana-6.1.6-1.fc29' one, which I actually did after taking reasonable steps to make sure that the Fedora version of 6.1.6 was compatible with the file layouts and so on from the Grafana version of 6.1.5. Why is this a problem? It's simple. If you're going to take over a package name from the upstream, you should keep up with the upstream releases. If you take over a package name and don't keep up to date or keep up to date only sporadically, you cause all sorts of heartburn for system administrators who use the package. The least annoying future of this situation is that Fedora has abandoned Grafana at 6.1.6 and I am going to 'upgrade' it with the upstream 6.2.1, which will hopefully be a transparent replacement and not blow up in my face. The most annoying future is that Fedora and Grafana keep ping-ponging versions back and forth, which will make 'dnf upgrade' into a minefield (because it will frequently try to give me a 'grafana' upgrade that I don't want and that would be dangerous to accept). And of course this situation turns Fedora version upgrades into their own minefield, since now I risk an upgrade to Fedora 30 actually reverting the 'grafana' package version on me.  Beastie Bits  [talk] ZFS v UFS on APU2 msata SSD with FreeBSD NetBSD 8.1 is out lazyboi – the laziest possible way to send raw HTTP POST data A Keyboard layout that changes by markov frequency Open Source Game Clones EuroBSDcon program &amp; registration open ***  Feedback/Questions  John - A segment idea Johnny - Audio only format please don't Alex - Thanks and some Linux Snaps vs PBI feedback   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv ***             Your browser does not support the HTML5 video tag.

<p>DragonFlyBSD's kernel optimizations pay off, differences between OpenBSD and Linux, NetBSD 2019 Google Summer of Code project list, Reducing that contention, fnaify 1.3 released, vmctl(8): CLI syntax changes, and things that Linux distributions should not do when packaging.</p> <h2>Headlines</h2> <h3><a href="https://www.phoronix.com/scan.php?page=article&amp;item=dragonfly-55-threadripper&amp;num=1" rel="nofollow" target="_blank">DragonFlyBSD's Kernel Optimizations Are Paying Off</a></h3> <blockquote> <p>DragonFlyBSD lead developer Matthew Dillon has been working on a big VM rework in the name of performance and other kernel improvements recently. Here is a look at how those DragonFlyBSD 5.5-DEVELOPMENT improvements are paying off compared to DragonFlyBSD 5.4 as well as FreeBSD 12 and five Linux distribution releases. With Dillon using an AMD Ryzen Threadripper system, we used that too for this round of BSD vs. Linux performance benchmarks.<br/> The work by Dillon on the VM overhaul and other changes (including more HAMMER2 file-system work) will ultimately culminate with the DragonFlyBSD 5.6 release (well, unless he opts for DragonFlyBSD 6.0 or so). These are benchmarks of the latest DragonFlyBSD 5.5-DEVELOPMENT daily ISO as of this week benchmarked across DragonFlyBSD 5.4.3 stable, FreeBSD 12.0, Ubuntu 19.04, Red Hat Enterprise Linux 8.0, Debian 9.9, Debian Buster, and CentOS 7 1810 as a wide variety of reference points both from newer and older Linux distributions. (As for no Clear Linux reference point for a speedy reference point, it currently has a regression with AMD + Samsung NVMe SSD support on some hardware, including this box, prohibiting the drive from coming up due to a presumed power management issue that is still being resolved.)<br/> With Matthew Dillon doing much of his development on an AMD Ryzen Threadripper system after he last year proclaimed the greatness of these AMD HEDT CPUs, for this round of testing I also used a Ryzen Threadripper 2990WX with 32 cores / 64 threads. Tests of other AMD/Intel hardware with DragonFlyBSD will come as the next stable release is near and all of the kernel work has settled down. For now it's mostly entertaining our own curiosity how well these DragonFlyBSD optimizations are paying off and how it's increasing the competition against FreeBSD 12 and Linux distributions.</p> </blockquote> <h3><a href="https://cfenollosa.com/blog/what-are-the-differences-between-openbsd-and-linux.html" rel="nofollow" target="_blank">What are the differences between OpenBSD and Linux?</a></h3> <blockquote> <p>Maybe you have been reading recently about the release of OpenBSD 6.5 and wonder, "What are the differences between Linux and OpenBSD?"<br/> I've also been there at some point in the past and these are my conclusions.<br/> They also apply, to some extent, to other BSDs. However, an important disclaimer applies to this article.<br/> This list is aimed at people who are used to Linux and are curious about OpenBSD. It is written to highlight the most important changes from their perspective, not the absolute most important changes from a technical standpoint.<br/> Please bear with me.</p> </blockquote> <ul> <li>A terminal is a terminal is a terminal</li> <li>Practical differences</li> <li>Security and system administration</li> <li>Why philosophical differences matter</li> <li>So what do I choose?</li> <li>How to try OpenBSD ***</li> </ul> <h2>News Roundup</h2> <h3><a href="http://blog.netbsd.org/tnf/entry/announcing_google_summer_of_code1" rel="nofollow" target="_blank">NetBSD 2019 Google Summer of Code</a></h3> <blockquote> <p>We are very happy to announce The NetBSD Foundation Google Summer of Code 2019 projects:</p> </blockquote> <ul> <li>Akul Abhilash Pillai - Adapting TriforceAFL for NetBSD kernel fuzzing</li> <li>Manikishan Ghantasala - Add KNF (NetBSD style) clang-format configuration</li> <li>Siddharth Muralee - Enhancing Syzkaller support for NetBSD</li> <li>Surya P - Implementation of COMPAT_LINUX and COMPAT_NETBSD32 DRM ioctls support for NetBSD kernel</li> <li>Jason High - Incorporation of Argon2 Password Hashing Algorithm into NetBSD</li> <li>Saurav Prakash - Porting NetBSD to HummingBoard Pulse</li> <li>Naveen Narayanan - Porting WINE to amd64 architecture on NetBSD</li> </ul> <blockquote> <p>The communiting bonding period - where students get in touch with mentors and community - started yesterday. The coding period will start from May 27 until August 19.<br/> Please welcome all our students and a big good luck to students and mentors! A big thank to Google and The NetBSD Foundation organization mentors and administrators! Looking forward to a great Google Summer of Code!</p> </blockquote> <h3><a href="http://www.grenadille.net/post/2019/05/09/Reducing-that-contention" rel="nofollow" target="_blank">Reducing that contention</a></h3> <blockquote> <p>The opening keynote at EuroBSDCon 2016 predicted the future 10 years of BSDs. Amongst all the funny previsions, gnn@FreeBSD said that by 2026 OpenBSD will have its first implementation of SMP. Almost 3 years after this talk, that sounds like a plausible forecast... Why? Where are we? What can we do? Let's dive into the issue!</p> </blockquote> <ul> <li>State of affairs</li> </ul> <blockquote> <p>Most of OpenBSD's kernel still runs under a single lock, ze KERNEL_LOCK(). That includes most of the syscalls, most of the interrupt handlers and most of the fault handlers. Most of them, not all of them. Meaning we have collected &amp; fixed bugs while setting up infrastructures and examples. Now this lock remains the principal responsible for the spin % you can observe in top(1) and systat(1).<br/> I believe that we opted for a difficult hike when we decided to start removing this lock from the bottom. As a result many SCSI &amp; Network interrupt handlers as well as all Audio &amp; USB ones can be executed without big lock. On the other hand very few syscalls are already or almost ready to be unlocked, as we incorrectly say. This explains why basic primitives like tsleep(9), csignal() and selwakeup() are only receiving attention now that the top of the Network Stack is running (mostly) without big lock.</p> </blockquote> <ul> <li>Next steps</li> </ul> <blockquote> <p>In the past years, most of our efforts have been invested into the Network Stack. As I already mentioned it should be ready to be parallelized. However think we should now concentrate on removing the KERNEL_LOCK(), even if the code paths aren't performance critical. </p> </blockquote> <ul> <li>See the Article for the rest of the post</li> </ul> <h3><a href="https://www.reddit.com/r/openbsd_gaming/comments/btste9/fnaify_13_released_more_games_are_fnaify_run_now/" rel="nofollow" target="_blank">fnaify 1.3 released - more games are "fnaify &amp; run" now</a></h3> <blockquote> <p>This release finally addresses some of the problems that prevent simple running of several games.<br/> This happens for example when an old FNA.dll library comes with the games that doesn't match the API of our native libraries like SDL2, OpenAL, or MojoShader anymore. Some of those cases can be fixed by simply dropping in a newer FNA.dll. fnaify now asks if FNA 17.12 should be automatically added if a known incompatible FNA version is found. You simply answer yes or no. </p> <p>Another blocker happens when the game expects to check the SteamAPI - either from a running Steam process, or a bundled steam_api library. OpenBSD 6.5-current now has steamworks-nosteam in ports, a stub library for <a href="http://Steamworks.NET" rel="nofollow" target="_blank">Steamworks.NET</a> that prevents games from crashing simply because an API function isn't found. The repo is here. fnaify now finds this library in /usr/local/share/steamstubs and uses it instead of the bundled (full) Steamworks.NET.dll.<br/> This may help with any games that use this layer to interact with the SteamAPI, mostly those that can only be obtained via Steam. </p> </blockquote> <h3><a href="https://www.openbsd.org/faq/current.html#r20190529" rel="nofollow" target="_blank">vmctl(8): command line syntax changed</a></h3> <blockquote> <p>The order of the arguments in the create, start, and stop commands of vmctl(8) has been changed to match a commonly expected style. Manual usage or scripting with vmctl must be adjusted to use the new syntax. <br/> For example, the old syntax looked like this:</p> </blockquote> <p><code># vmctl create disk.qcow2 -s 50G</code></p> <blockquote> <p>The new syntax specifies the command options before the argument:</p> </blockquote> <p><code># vmctl create -s 50G disk.qcow2</code></p> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/linux/PackageNameClashProblem" rel="nofollow" target="_blank">Something that Linux distributions should not do when packaging things</a></h3> <blockquote> <p>Right now I am a bit unhappy at Fedora for a specific packaging situation, so let me tell you a little story of what I, as a system administrator, would really like distributions to not do.<br/> For reasons beyond the scope of this blog entry, I run a Prometheus and Grafana setup on both my home and office Fedora Linux machines (among other things, it gives me a place to test out various things involving them). When I set this up, I used the official upstream versions of both, because I needed to match what we are running (or would soon be).<br/> Recently, Fedora decided to package Grafana themselves (as a RPM), and they called this RPM package 'grafana'. Since the two different packages are different versions of the same thing as far as package management tools are concerned, Fedora basically took over the 'grafana' package name from Grafana. This caused my systems to offer to upgrade me from the <a href="http://Grafana.com" rel="nofollow" target="_blank">Grafana.com</a> 'grafana-6.1.5-1' package to the Fedora 'grafana-6.1.6-1.fc29' one, which I actually did after taking reasonable steps to make sure that the Fedora version of 6.1.6 was compatible with the file layouts and so on from the Grafana version of 6.1.5.<br/> Why is this a problem? It's simple. If you're going to take over a package name from the upstream, you should keep up with the upstream releases. If you take over a package name and don't keep up to date or keep up to date only sporadically, you cause all sorts of heartburn for system administrators who use the package. The least annoying future of this situation is that Fedora has abandoned Grafana at 6.1.6 and I am going to 'upgrade' it with the upstream 6.2.1, which will hopefully be a transparent replacement and not blow up in my face. The most annoying future is that Fedora and Grafana keep ping-ponging versions back and forth, which will make 'dnf upgrade' into a minefield (because it will frequently try to give me a 'grafana' upgrade that I don't want and that would be dangerous to accept). And of course this situation turns Fedora version upgrades into their own minefield, since now I risk an upgrade to Fedora 30 actually reverting the 'grafana' package version on me.</p> </blockquote> <h2>Beastie Bits</h2> <ul> <li><a href="http://lists.nycbug.org:8080/pipermail/talk/2019-May/017885.html" rel="nofollow" target="_blank">[talk] ZFS v UFS on APU2 msata SSD with FreeBSD</a></li> <li><a href="http://www.netbsd.org/releases/formal-8/NetBSD-8.1.html" rel="nofollow" target="_blank">NetBSD 8.1 is out</a></li> <li><a href="https://github.com/ctsrc/lazyboi" rel="nofollow" target="_blank">lazyboi – the laziest possible way to send raw HTTP POST data</a></li> <li><a href="https://github.com/shapr/markovkeyboard" rel="nofollow" target="_blank">A Keyboard layout that changes by markov frequency</a></li> <li><a href="https://osgameclones.com/" rel="nofollow" target="_blank">Open Source Game Clones</a></li> <li><a href="https://eurobsdcon.org" rel="nofollow" target="_blank">EuroBSDcon program &amp; registration open</a> ***</li> </ul> <h2>Feedback/Questions</h2> <ul> <li>John - <a href="http://dpaste.com/3YTBQTX#wrap" rel="nofollow" target="_blank">A segment idea</a></li> <li>Johnny - <a href="http://dpaste.com/3WD0A25#wrap" rel="nofollow" target="_blank">Audio only format please don't</a></li> <li>Alex - <a href="http://dpaste.com/1RQF4QM#wrap" rel="nofollow" target="_blank">Thanks and some Linux Snaps vs PBI feedback</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a> ***</li> </ul>            Your browser does not support the HTML5 video tag.

302: Contention Reduction

FreeBSD ZFS vs. ZoL performance, Dragonfly 5.4.2 has been release, containing web services with iocell, Solaris 11.4 SRU8, Problem with SSH Agent forwarding, OpenBSD 6.4 to 6.5 upgrade guide, and more. Headlines FreeBSD ZFS vs. ZoL Performance, Ubuntu ZFS On Linux Reference  With iX Systems having released new images of FreeBSD reworked with their ZFS On Linux code that is in development to ultimately replace their existing FreeBSD ZFS support derived from the code originally found in the Illumos source tree, here are some fresh benchmarks looking at the FreeBSD 12 performance of ZFS vs. ZoL vs. UFS and compared to Ubuntu Linux on the same system with EXT4 and ZFS.  Using an Intel Xeon E3-1275 v6 with ASUS P10S-M WS motherboard, 2 x 8GB DDR4-2400 ECC UDIMMs, and Samsung 970 EVO Plus 500GB NVMe solid-state drive was used for all of this round of testing. Just a single modern NVMe SSD was used for this round of ZFS testing while as the FreeBSD ZoL code matures I'll test on multiple systems using a more diverse range of storage devices.  FreeBSD 12 ZoL was tested using the iX Systems image and then fresh installs done of FreeBSD 12.0-RELEASE when defaulting to the existing ZFS root file-system support and again when using the aging UFS file-system. Ubuntu 18.04.2 LTS with the Linux 4.18 kernel was used when testing its default EXT4 file-system and then again when using the Ubuntu-ZFS ZoL support. Via the Phoronix Test Suite various BSD/Linux I/O benchmarks were carried out.  Overall, the FreeBSD ZFS On Linux port is looking good so far and we are looking forward to it hopefully maturing in time for FreeBSD 13.0. Nice job to iX Systems and all of those involved, especially the ZFS On Linux project. Those wanting to help in testing can try the FreeBSD ZoL spins. Stay tuned for more benchmarks and on more diverse hardware as time allows and the FreeBSD ZoL support further matures, but so far at least the performance numbers are in good shape.   DragonFlyBSD 5.4.2 is out Upgrading guide  Here's the tag commit, for what has changed from 5.4.1 to 5.4.2  The normal ISO and IMG files are available for download and install, plus an uncompressed ISO image for those installing remotely.  I uploaded them to mirror-master.dragonflybsd.org last night so they should be at your local mirror or will be soon.  This version includes Matt's fix for the HAMMER2 corruption bug he identified recently.  If you have an existing 5.4 system and are running a generic kernel, the normal upgrade process will work.  &gt; cd /usr/src&gt; git pull&gt; make buildworld.&gt; make buildkernel.&gt; make installkernel.&gt; make installworld&gt; make upgrade  After your next reboot, you can optionally update your rescue system:  &gt; cd /usr/src&gt; make initrd  As always, make sure your packages are up to date:  &gt; pkg update&gt; pkg upgrade  News Roundup Containing web services with iocell  I'm a huge fan of the FreeBSD jails feature. It is a great system for splitting services into logical units with all the performance of the bare metal system. In fact, this very site runs in its own jail! If this is starting to sound like LXC or Docker, it might surprise you to learn that OS-level virtualization has existed for quite some time. Kudos to the Linux folks for finally getting around to it. 😛   If you're interested in the history behind Jails, there is an excellent talk from Papers We Love on the subject: https://www.youtube.com/watch?v=hgN8pCMLI2U   Getting started   There are plenty of options when it comes to setting up the jail system. Ezjail and Iocage seem popular, or you could do things manually. Iocage was recently rewritten in python, but was originally a set of shell scripts. That version has since been forked under the name Iocell, and I think it's pretty neat, so this tutorial will be using Iocell.   To start, you'll need the following: A FreeBSD install (we'll be using 11.0) The iocell package (available as a package, also in the ports tree) A ZFS pool for hosting the jails    Once you have installed iocell and configured your ZFS pool, you'll need to run a few commands before creating your first jail. First, tell iocell which ZFS pool to use by issuing  iocell activate $POOLNAME. Iocell will create a few datasets. As you can imagine, your jails are contained within the /iocell/jails dataset. The  /iocell/releases dataset is used for storing the next command we need to run,  iocell fetch. Iocell will ask you which release you'd like to pull down. Since we're running 11.0 on the host, pick 11.0-RELEASE. Iocell will download the necessary txz files and unpack them in /iocell/releases.   See Article for the rest of the walkthrough.   Oracle Solaris 11.4 SRU8  Today we are releasing the SRU 8 for Oracle Solaris 11.4. It is available via 'pkg update' from the support repository or by downloading the SRU from My Oracle Support Doc ID 2433412.1.  This SRU introduces the following enhancements: Integration of 28060039 introduced an issue where any firmware update/query commands will log eereports and repeated execution of such commands led to faulty/degraded NIC. The issue has been addressed in this SRU. UCB (libucb, librpcsoc, libdbm, libtermcap, and libcurses) libraries have been reinstated for Oracle Solaris 11.4 Re-introduction of the service fc-fabric. ibus has been updated to 1.5.19     The following components have also been updated to address security issues: NTP has been updated to 4.2.8p12 Firefox has been updated to 60.6.0esr BIND has been updated to 9.11.6 OpenSSL has been updated to 1.0.2r MySQL has been updated to 5.6.43 &amp; 5.7.25 libxml2 has been updated to 2.9.9 libxslt has been updated to 1.1.33 Wireshark has been updated to 2.6.7 ncurses has been updated to 6.1.0.20190105 Apache Web Server has been updated to 2.4.38 perl 5.22 pkg.depot    The Problem with SSH Agent Forwarding  After hacking the matrix.org website today, the attacker opened a series of GitHub issues mentioning the flaws he discovered. In one of those issues, he mentions that “complete compromise could have been avoided if developers were prohibited from using [SSH agent forwarding].”  Here’s what man ssh_config has to say about ForwardAgent:  "Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.""  Simply put: if your jump box is compromised and you use SSH agent forwarding to connect to another machine through it, then you risk also compromising the target machine!  Instead, you should use either ProxyCommand or ProxyJump (added in OpenSSH 7.3). That way, ssh will forward the TCP connection to the target host via the jump box and the actual connection will be made on your workstation. If someone on the jump box tries to MITM your connection, then you will be warned by ssh.   [OpenBSD Upgrade Guide: 6.4 to 6.5  Start by performing the pre-upgrade steps. Next, boot from the install kernel, bsd.rd: use bootable install media, or place the 6.5 version of bsd.rd in the root of your filesystem and instruct the boot loader to boot this kernel. Once this kernel is booted, choose the (U)pgrade option and follow the prompts. Apply the configuration changes and remove the old files. Finish up by upgrading the packages: pkg_add -u.  Alternatively, you can use the manual upgrade process.  You may wish to check the errata page or upgrade to the stable branch to get any post-release fixes.   Before rebooting into the install kernel Configuration and syntax changes Files to remove Special packages Upgrade without the install kernel   Beastie Bits  2019 FreeBSD Community Survey Seagate runs Mach.2 demo on FreeBSD FreeBSD: Resizing and Growing Disks Loading 4.9 on an old Tandy 4025LX - 386, 16MB, 1GB HD. Good old external SCSI CD OS108 MATE 20190422 released   Feedback/Questions  Casey - Oklahoma City &amp; James Michael - Question on SAS backplane (camcontrol?) Ales - OpenBSD, FreeNAS, OpenZFS questions    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv          Your browser does not support the HTML5 video tag.

<p>FreeBSD ZFS vs. ZoL performance, Dragonfly 5.4.2 has been release, containing web services with iocell, Solaris 11.4 SRU8, Problem with SSH Agent forwarding, OpenBSD 6.4 to 6.5 upgrade guide, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.phoronix.com/scan.php?page=article&amp;item=freebsd-zol-april&amp;num=1" rel="nofollow" target="_blank">FreeBSD ZFS vs. ZoL Performance, Ubuntu ZFS On Linux Reference</a></h3> <blockquote> <p>With iX Systems having released new images of FreeBSD reworked with their ZFS On Linux code that is in development to ultimately replace their existing FreeBSD ZFS support derived from the code originally found in the Illumos source tree, here are some fresh benchmarks looking at the FreeBSD 12 performance of ZFS vs. ZoL vs. UFS and compared to Ubuntu Linux on the same system with EXT4 and ZFS.<br>  Using an Intel Xeon E3-1275 v6 with ASUS P10S-M WS motherboard, 2 x 8GB DDR4-2400 ECC UDIMMs, and Samsung 970 EVO Plus 500GB NVMe solid-state drive was used for all of this round of testing. Just a single modern NVMe SSD was used for this round of ZFS testing while as the FreeBSD ZoL code matures I'll test on multiple systems using a more diverse range of storage devices.<br>  FreeBSD 12 ZoL was tested using the iX Systems image and then fresh installs done of FreeBSD 12.0-RELEASE when defaulting to the existing ZFS root file-system support and again when using the aging UFS file-system. Ubuntu 18.04.2 LTS with the Linux 4.18 kernel was used when testing its default EXT4 file-system and then again when using the Ubuntu-ZFS ZoL support. Via the Phoronix Test Suite various BSD/Linux I/O benchmarks were carried out.<br>  Overall, the FreeBSD ZFS On Linux port is looking good so far and we are looking forward to it hopefully maturing in time for FreeBSD 13.0. Nice job to iX Systems and all of those involved, especially the ZFS On Linux project. Those wanting to help in testing can try the FreeBSD ZoL spins. Stay tuned for more benchmarks and on more diverse hardware as time allows and the FreeBSD ZoL support further matures, but so far at least the performance numbers are in good shape.</p> </blockquote> <p></p> <h3><a href="https://www.dragonflybsd.org/release54/" rel="nofollow" target="_blank">DragonFlyBSD 5.4.2 is out</a></h3> <p><a href="http://lists.dragonflybsd.org/pipermail/users/2019-April/358160.html" rel="nofollow" target="_blank">Upgrading guide</a></p> <blockquote> <p>Here's the tag commit, for what has changed from <a href="http://lists.dragonflybsd.org/pipermail/commits/2019-April/718697.html" rel="nofollow" target="_blank">5.4.1 to 5.4.2</a><br>  The normal ISO and IMG files are available for download and install, plus an uncompressed ISO image for those installing remotely.  I uploaded them to <a href="http://mirror-master.dragonflybsd.org" rel="nofollow" target="_blank">mirror-master.dragonflybsd.org</a> last night so they should be at your local mirror or will be soon.  This version includes Matt's fix for the HAMMER2 corruption bug he identified recently.<br>  If you have an existing 5.4 system and are running a generic kernel, the normal upgrade process will work.</p> </blockquote> <code>&gt; cd /usr/src<br>&gt; git pull<br>&gt; make buildworld.<br>&gt; make buildkernel.<br>&gt; make installkernel.<br>&gt; make installworld<br>&gt; make upgrade<br></code> <blockquote> <p>After your next reboot, you can optionally update your rescue system:</p> </blockquote> <code>&gt; cd /usr/src<br>&gt; make initrd<br></code> <blockquote> <p>As always, make sure your packages are up to date:</p> </blockquote> <code>&gt; pkg update<br>&gt; pkg upgrade<br></code> <p></p> <h2>News Roundup</h2> <h3><a href="https://gioarc.me/2017/03/05/containing-web-services-with-iocell/" rel="nofollow" target="_blank">Containing web services with iocell</a></h3> <blockquote> <p>I'm a huge fan of the FreeBSD jails feature. It is a great system for splitting services into logical units with all the performance of the bare metal system. In fact, this very site runs in its own jail! If this is starting to sound like LXC or Docker, it might surprise you to learn that OS-level virtualization has existed for quite some time. Kudos to the Linux folks for finally getting around to it. 😛 <br>  If you're interested in the history behind Jails, there is an excellent talk from Papers We Love on the subject: <a href="https://www.youtube.com/watch?v=hgN8pCMLI2U" rel="nofollow" target="_blank">https://www.youtube.com/watch?v=hgN8pCMLI2U</a></p> </blockquote> <ul> <li>Getting started</li> </ul> <blockquote> <p>There are plenty of options when it comes to setting up the jail system. Ezjail and Iocage seem popular, or you could do things manually. Iocage was recently rewritten in python, but was originally a set of shell scripts. That version has since been forked under the name Iocell, and I think it's pretty neat, so this tutorial will be using Iocell.</p> </blockquote> <ul> <li>To start, you'll need the following:<br><ul> <li>A FreeBSD install (we'll be using 11.0)</li> <li>The iocell package (available as a package, also in the ports tree)</li> <li>A ZFS pool for hosting the jails</li></ul> </li> </ul> <blockquote> <p>Once you have installed iocell and configured your ZFS pool, you'll need to run a few commands before creating your first jail. First, tell iocell which ZFS pool to use by issuing  iocell activate $POOLNAME. Iocell will create a few datasets.</p> <p>As you can imagine, your jails are contained within the /iocell/jails dataset. The  /iocell/releases dataset is used for storing the next command we need to run,  iocell fetch. Iocell will ask you which release you'd like to pull down. Since we're running 11.0 on the host, pick 11.0-RELEASE. Iocell will download the necessary txz files and unpack them in /iocell/releases.</p> </blockquote> <ul> <li>See Article for the rest of the walkthrough.</li> </ul> <p></p> <h3><a href="https://blogs.oracle.com/solaris/announcing-oracle-solaris-114-sru8" rel="nofollow" target="_blank">Oracle Solaris 11.4 SRU8</a></h3> <blockquote> <p>Today we are releasing the SRU 8 for Oracle Solaris 11.4. It is available via 'pkg update' from the support repository or by downloading the SRU from My Oracle Support Doc ID 2433412.1.</p> <ul> <li>This SRU introduces the following enhancements:<br><ul> <li>Integration of 28060039 introduced an issue where any firmware update/query commands will log eereports and repeated execution of such commands led to faulty/degraded NIC. The issue has been addressed in this SRU.</li> <li>UCB (libucb, librpcsoc, libdbm, libtermcap, and libcurses) libraries have been reinstated for Oracle Solaris 11.4</li> <li>Re-introduction of the service fc-fabric.</li> <li>ibus has been updated to 1.5.19</li></ul> </li> </ul> </blockquote> <ul> <li>The following components have also been updated to address security issues:<br><ul> <li>NTP has been updated to 4.2.8p12</li> <li>Firefox has been updated to 60.6.0esr</li> <li>BIND has been updated to 9.11.6</li> <li>OpenSSL has been updated to 1.0.2r</li> <li>MySQL has been updated to 5.6.43 &amp; 5.7.25</li> <li>libxml2 has been updated to 2.9.9</li> <li>libxslt has been updated to 1.1.33</li> <li>Wireshark has been updated to 2.6.7</li> <li>ncurses has been updated to 6.1.0.20190105</li> <li>Apache Web Server has been updated to 2.4.38</li> <li>perl 5.22</li> <li>pkg.depot</li></ul> </li> </ul> <p></p> <h3><a href="https://defn.io/2019/04/12/ssh-forwarding/" rel="nofollow" target="_blank">The Problem with SSH Agent Forwarding</a></h3> <blockquote> <p>After hacking the <a href="http://matrix.org" rel="nofollow" target="_blank">matrix.org</a> website today, the attacker opened a series of GitHub issues mentioning the flaws he discovered. In one of those issues, he mentions that “complete compromise could have been avoided if developers were prohibited from using [SSH agent forwarding].”<br>  Here’s what man ssh_config has to say about ForwardAgent:  "Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent’s Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.""<br>  Simply put: if your jump box is compromised and you use SSH agent forwarding to connect to another machine through it, then you risk also compromising the target machine!<br>  Instead, you should use either ProxyCommand or ProxyJump (added in OpenSSH 7.3). That way, ssh will forward the TCP connection to the target host via the jump box and the actual connection will be made on your workstation. If someone on the jump box tries to MITM your connection, then you will be warned by ssh.</p> </blockquote> <p></p> <h3>[<a href="https://www.openbsd.org/faq/upgrade65.html" rel="nofollow" target="_blank">OpenBSD Upgrade Guide: 6.4 to 6.5</a></h3> <blockquote> <p>Start by performing the pre-upgrade steps. Next, boot from the install kernel, bsd.rd: use bootable install media, or place the 6.5 version of bsd.rd in the root of your filesystem and instruct the boot loader to boot this kernel. Once this kernel is booted, choose the (U)pgrade option and follow the prompts. Apply the configuration changes and remove the old files. Finish up by upgrading the packages: pkg_add -u.<br>  Alternatively, you can use the manual upgrade process.<br>  You may wish to check the errata page or upgrade to the stable branch to get any post-release fixes.</p> </blockquote> <ul> <li>Before rebooting into the install kernel</li> <li>Configuration and syntax changes</li> <li>Files to remove</li> <li>Special packages</li> <li>Upgrade without the install kernel</li> </ul> <p></p> <h2>Beastie Bits</h2> <ul> <li><a href="https://lists.freebsd.org/pipermail/freebsd-announce/2019-April/001873.html" rel="nofollow" target="_blank">2019 FreeBSD Community Survey</a></li> <li><a href="https://blog.seagate.com/craftsman-ship/seagate-shows-dual-actuator-speed-gains-in-real-world-setup/" rel="nofollow" target="_blank">Seagate runs Mach.2 demo on FreeBSD</a></li> <li><a href="https://www.youtube.com/watch?v=2KoD-jXjHok&amp;t=7s" rel="nofollow" target="_blank">FreeBSD: Resizing and Growing Disks</a></li> <li><a href="https://old.reddit.com/r/freebsd/comments/bh1abv/loading_49_on_an_old_tandy_4025lx_386_16mb_1gb_hd/" rel="nofollow" target="_blank">Loading 4.9 on an old Tandy 4025LX - 386, 16MB, 1GB HD. Good old external SCSI CD</a></li> <li><a href="https://forums.os108.org/d/6-os108-mate-20190422-released" rel="nofollow" target="_blank">OS108 MATE 20190422 released</a></li> </ul> <p></p> <h2>Feedback/Questions</h2> <ul> <li>Casey - <a href="http://dpaste.com/39VJ7NH#wrap" rel="nofollow" target="_blank">Oklahoma City &amp; James</a></li> <li>Michael - <a href="http://dpaste.com/2VSKEGW#wrap" rel="nofollow" target="_blank">Question on SAS backplane (camcontrol?)</a></li> <li>Ales - <a href="http://dpaste.com/0AD0HBY#wrap" rel="nofollow" target="_blank">OpenBSD, FreeNAS, OpenZFS questions</a></li> </ul> <p></p> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li> </ul> <p></p>    <br>    Your browser does not support the HTML5 video tag.

297: Dragonfly In The Wild

This week we have a special episode with a Michael W. Lucas interview about his latest jail book that’s been released. We’re talking all things jails, writing, book sponsoring, the upcoming BSDCan 2019 conference, and more. ###Interview - Michael W. Lucas  - mwl@mwl.io / @mwlauthor FreeBSD Mastery: Jails  BR: Welcome back to the show and congratulations on your latest book. How many books did you have to write before you could start on FreeBSD Mastery: Jails? AJ: How much research did you have to do about jails? BR: The book talks about something called ‘incomplete’ jails. What do you mean by that? AJ: There are a lot of jail management frameworks out there. Why did you chose to write about iocage in the book? BR: How many jails do you run yourself? AJ: Can you tell us a bit about how you handle book sponsorship these days? BR: What other books (fiction and non-fiction) are you currently working on? AJ: Which talks are you looking forward to attend at the upcoming BSDCan conference? BR: How is the BSD user group going? AJ: Anything else you’d like to mention before we release you from our interview jail cell?    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv              Your browser does not support the HTML5 video tag.

<p>This week we have a special episode with a Michael W. Lucas interview about his latest jail book that’s been released. We’re talking all things jails, writing, book sponsoring, the upcoming BSDCan 2019 conference, and more.</p> <p>###Interview - Michael W. Lucas  - <a href="mailto:mwl@mwl.io">mwl@mwl.io</a> / <a href="https://twitter.com/mwlauthor" rel="nofollow" target="_blank">@mwlauthor</a><br/> FreeBSD Mastery: Jails</p> <ul> <li>BR: Welcome back to the show and congratulations on your latest book. How many books did you have to write before you could start on FreeBSD Mastery: Jails?</li> <li>AJ: How much research did you have to do about jails?</li> <li>BR: The book talks about something called ‘incomplete’ jails. What do you mean by that?</li> <li>AJ: There are a lot of jail management frameworks out there. Why did you chose to write about iocage in the book?</li> <li>BR: How many jails do you run yourself?</li> <li>AJ: Can you tell us a bit about how you handle book sponsorship these days?</li> <li>BR: What other books (fiction and non-fiction) are you currently working on?</li> <li>AJ: Which talks are you looking forward to attend at the upcoming BSDCan conference?</li> <li>BR: How is the BSD user group going?</li> <li>AJ: Anything else you’d like to mention before we release you from our interview jail cell?</li> </ul> <p></p> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv">feedback@bsdnow.tv</a></li> </ul> <p></p>            Your browser does not support the HTML5 video tag.

293: Booking Jails

Mitigating Spectre/Meltdown on HP Proliant servers, omniOS installation setup, debugging a memory corruption issue on OpenBSD, CfT for OpenZFS native encryption, Asigra TrueNAS backup appliance shown at VMworld, NetBSD 6 EoL, and more.  ##Headlines ###How to mitigate Spectre and Meltdown on an HP Proliant server with FreeBSD  As recently announced in a previous article I wanted to write a couple of guides on how to mitigate Spectre and Meltdown vulnerabilities in GNU/Linux and UNIX environments. It is always a good and I hope a standard practice to have your systems patched and if they aren’t for whatever the reason (that legacy thing you’re carrying on for ages) you may take the necessary extra steps to protect your environment. I never planned to do any article on patching anything. Nowadays it’s a no brainer and operating systems have provided the necessary tools for this to be easy and as smooth as possible. So why this article? Spectre and Meltdown are both hardware vulnerabilities. Major ones. They are meaningful for several reasons among them the world wide impact since they affect Intel and AMD systems which are ubiquitous. And second because patching hardware is not as easy, for the manufacturer and for the users or administrators in charge of the systems. There is still no known exploit around left out in the open hitting servers or desktops anywhere. The question is not if it will ever happen. The question is when will it happen. And it may be sooner than later. This is why big companies, governments and people in charge of big deployments are patching or have already patched their systems. But have you done it to your system? I know you have a firewall. Have you thought about CVE-2018-3639? This particular one could make your browser being a vector to get into your system. So, no, there is no reason to skip this. Patching these set of vulnerabilities implies some more steps and concerns than updating the operating system. If you are a regular Windows user I find rare you to be here and many of the things you will read may be foreign to you. I am not planning to do a guide on Windows systems since I believe someone else has or will do it and will do it better than me since I am not a pro Windows user. However there is one basic and common thing for all OS’s when dealing with Spectre and Meltdown and that is a microcode update is necessary for the OS patches to effectively work. What is microcode? You can read the Wikipedia article but in short it is basically a layer of code that allows chip manufacturers to deal with modifications on the hardware they’ve produced and the operating systems that will manage that hardware. Since there’s been some issues (namely Spectre and Meltdown) Intel and AMD respectively have released a series of microcode updates to address those problems. First series did come with serious problems and some regressions, to the point GNU/Linux producers stopped releasing the microcode updates through their release channels for updates and placed the ball on Intel’s roof. Patching fast does always include risks, specially when dealing with hardware. OS vendors have resumed their microcode update releases so all seems to be fine now. In order to update the microcode we’re faced with two options. Download the most recent BIOS release from our vendor, provided it patches the Spectre and Meltdown vulnerabilities, or patch it from the OS. If your hardware vendor has decided not to provide support on your hardware you are forced to use the latter solution. Yes, you can still keep your hardware. They usually come accompanied with a “release notes” file where there are some explanatory notes on what is fixed, what is new, etc. To make the search easy for you a news site collected the vendors list and linked the right support pages for anyone to look. In some scenarios it would be desirable not to replace the whole BIOS but just update the microcode from the OS side. In my case I should update an HP Proliant ML110 G7 box and the download link for that would be this. Instead of using the full blown BIOS update path we’ll use the inner utilities to patch Spectre and Meltdown on FreeBSD. So let’s put our hands on it   See the article for the technical breakdown   ###A look beyond the BSD teacup: OmniOS installation  Five years ago I wrote a post about taking a look beyond the Linux teacup. I was an Arch Linux user back then and since there were projects like ArchBSD (called PacBSD today) and Arch Hurd, I decided to take a look at and write about them. Things have changed. Today I’m a happy FreeBSD user, but it’s time again to take a look beyond the teacup of operating systems that I’m familiar with.   Why Illumos / OmniOS?   There are a couple of reasons. The Solaris derivatives are the other big community in the *nix family besides Linux and the BSDs and we hadn’t met so far. Working with ZFS on FreeBSD, I now and then I read messages that contain a reference to Illumos which certainly helps to keep up the awareness. Of course there has also been a bit of curiosity – what might the OS be like that grew ZFS? Also the Ravenports project that I participate in planned to support Solaris/Illumos right from the beginning. I wanted to at least be somewhat “prepared” when support for that platform would finally land. So I did a little research on the various derivatives available and settled on the one that I had heard a talk about at last year’s conference of the German Unix Users Group: “OmniOS – Solaris for the Rest of Us”. I would have chosen SmartOS as I admire what Bryan Cantrill does but for getting to know Illumos I prefer a traditional installation over a run-from-RAM system. Of course FreeBSD is not run by corporations, especially when compared to the state of Linux. And when it comes to sponsoring, OpenBSD also takes the money… When it comes to FreeBSD developers, there’s probably some truth to the claim that some of them are using macOS as their desktop systems while OpenBSD devs are more likely to develop on their OS of choice. But then there’s the statement that “every innovation in the past decade comes from Solaris”. Bhyve alone proves this wrong. But let’s be honest: Two of the major technologies that make FreeBSD a great platform today – ZFS and DTrace – actually do come from Solaris. PAM originates there and a more modern way of managing services as well. Also you hear good things about their zones and a lot of small utilities in general. In the end it was a lack of time that made me cheat and go down the easiest road: Create a Vagrantfile and just pull a VM image of the net that someone else had prepared… This worked to just make sure that the Raven packages work on OmniOS. I was determined to return, though – someday. You know how things go: “someday” is a pretty common alias for “probably never, actually.” But then I heard about a forum post on the BSDNow! podcast. The title “Initial OmniOS impressions by a BSD user” caught my attention. I read that it was written by somebody who had used FreeBSD for years but loathed the new Code of Conduct enough to leave. I also oppose the Conduct and have made that pretty clear in my February post [ ! -z ${COC} ] &amp;&amp; exit 1. As stated there, I have stayed with my favorite OS and continue to advocate it. I decided to stop reading the post and try things out on my own instead. Now I’ve finally found the time to do so.   What’s next?   That’s it for part one. In part two I’ll try to make the system useful. So far I have run into a problem that I haven’t been able to solve. But I have some time now to figure things out for the next post. Let’s see if I manage to get it working or if I have to report failure!   ###What are all these types of memory in top(1)?  Earlier this week I convinced Mark Johnston, one of the FreeBSD VM experts to update a page on the FreeBSD wiki that I saw was being referenced on stackoverflow and similar sites Mark updated the explanations to be more correct, and to include more technical detail for inquiring minds He also added the new type that appeared in FreeBSD somewhat recently   Active - Contains memory “actively” (recently) being used by applications Inactive - Contains memory that has not been touched recently, or was released from the Buffer Cache Laundry - Contains memory that Inactive but still potentially contains useful data that needs to be stored before this memory can be used again Wired - Memory that cannot be swapped out, including the kernel, network stack, and the ZFS ARC Buf - Buffer Cache, used my UFS and most filesystems except ZFS (which uses the ARC) Free - Memory that is immediately available for use by the rest of the system   ##News Roundup ###OpenBSD saves me again! — Debug a memory corruption issue  Yesterday, I came across a third-part library issue, which crashes at allocating memory:  Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6 (gdb) bt #0 0x00007f594a5a9b6b in _int_malloc () from /usr/lib/libc.so.6 #1 0x00007f594a5ab503 in malloc () from /usr/lib/libc.so.6 #2 0x00007f594b13f159 in operator new (sz=5767168) at /build/gcc/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50  It is obvious that the memory tags are corrupted, but who is the murder? Since the library involves a lot of maths computation, it is not an easy task to grasp the code quickly. So I need to find another way: (1) Open all warnings during compilation: -Wall. Nothing found. (2) Use valgrind, but unfortunately, valgrind crashes itself:  valgrind: the 'impossible' happened: Killed by fatal signal  host stacktrace: ==43326== at 0x58053139: get_bszB_as_is (m_mallocfree.c:303) ==43326== by 0x58053139: get_bszB (m_mallocfree.c:315) ==43326== by 0x58053139: vgPlain_arena_malloc (m_mallocfree.c:1799) ==43326== by 0x5800BA84: vgMemCheck_new_block (mc_malloc_wrappers.c:372) ==43326== by 0x5800BD39: vgMemCheck___builtin_vec_new (mc_malloc_wrappers.c:427) ==43326== by 0x5809F785: do_client_request (scheduler.c:1866) ==43326== by 0x5809F785: vgPlain_scheduler (scheduler.c:1433) ==43326== by 0x580AED50: thread_wrapper (syswrap-linux.c:103) ==43326== by 0x580AED50: run_a_thread_NORETURN (syswrap-linux.c:156)  sched status: running_tid=1  (3) Change compiler, use clang instead of gcc, and hope it can give me some clues. Still no effect. (4) Switch Operating System from Linux to OpenBSD, the program crashes again. But this time, it tells me where the memory corruption occurs:  Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000014b07f01e52d in addMod (r=, a=4693443247995522, b=28622907746665631,  I figure out the issue quickly, and not bother to understand the whole code. OpenBSD saves me again, thanks!   ###Native Encryption for ZFS on FreeBSD (Call for Testing)  To anyone with an interest in native encryption in ZFS please test the projects/zfs-crypto-merge-0820 branch in my freebsd repo: https://github.com/mattmacy/networking.git  git clone https://github.com/mattmacy/networking.git -b projects/zfs-crypto-merge-0820  The UI is quite close to the Oracle Solaris ZFS crypto with minor differences for specifying key location. Please note that once a feature is enabled on a pool it can’t be disabled. This means that if you enable encryption support on a pool you will never be able to import it in to a ZFS without encryption support. For this reason I would strongly advise against using this on any pool that can’t be easily replaced until this change has made its way in to HEAD after the freeze has been lifted. By way of background the original ZoL commit can be found at:   https://github.com/zfsonlinux/zfs/pull/5769/commits/5aef9bedc801830264428c64cd2242d1b786fd49   ###VMworld 2018: Showcasing Hybrid Cloud, Persistent Memory and the Asigra TrueNAS Backup Appliance  During its last year in Las Vegas before moving back to San Francisco, VMworld was abuzz with all the popular buzzwords, but the key focus was on supporting a more agile approach to hybrid cloud. Surveys of IT stakeholders and analysts agree that most businesses have multiple clouds spanning both public cloud providers and private data centers. While the exact numbers vary, well over half of businesses have a hybrid cloud strategy consisting of at least three different clouds. This focus on hybrid cloud provided the perfect timing for our announcement that iXsystems and Asigra are partnering to deliver the Asigra TrueNAS Backup Appliance, which combines Asigra Cloud Backup software backed by TrueNAS storage. Asigra TrueNAS Backup Appliances provide a self-healing and ransomware-resistent OpenZFS backup repository in your private cloud. The appliance can simultaneously be used as general-purpose file, block, and object storage. How does this tie in with the hybrid cloud? The Asigra Cloud Backup software can backup data from public cloud repositories – G Suite, Office 365, Salesforce, etc. – as well as intelligently move backed-up data to the public cloud for long-term retention. Another major theme at the technical sessions was persistent memory, as vSphere 6.7 added support for persistent memory – either as a storage tier or virtualized and presented to a guest OS. As detailed in our blog post from SNIA’s Persistent Memory Summit 2018, persistent memory is rapidly becoming mainstream. Persistent memory bridges the gap between memory and flash storage – providing near-memory latency storage that persists across reboots or power loss. vSphere allows both legacy and persistent memory-aware applications to leverage this ultra-fast storage tier. We were excited to show off our newly-introduced TrueNAS M-Series at VMworld, as all TrueNAS M40 and M50 models leverage NVDIMM persistent memory technology to provide a super-fast write cache, or SLOG, without any of the limitations of Flash technology. The iXsystems booth’s theme was “Enterprise Storage, Open Source Economics”. iXsystems leverages the power of Open Source software, combined with our enterprise-class hardware and support, to provide incredibly low TCO storage for virtualization environments. Our TrueNAS unified storage and server offerings are an ideal solution for your organization’s private cloud infrastructure. Combined with VMware NSX Hybrid Connect – formerly known as VMware Hybrid Cloud Extension – you can seamlessly shift running systems into a public cloud environment for a true hybrid cloud solution. Another special treat at this year’s booth was iXsystems Vice President of Engineering Kris Moore giving demos of an early version of “Project TrueView”, a single-pane of glass management solution for administration of multiple FreeNAS and TrueNAS systems. In addition to simplified administration and enhanced monitoring, Project TrueView will also provide Role-Based Access Control for finer-grained permissions management. A beta version of Project TrueView is expected to be available at the end of this year. Overall, we had a great week at VMworld 2018 with lots of good conversations with customers, press, analysts, and future customers about TrueNAS, the Asigra TrueNAS Backup Appliance, iXsystems servers, Project TrueView, and more – our booth was more popular than ever!   ###End of life for NetBSD 6.x  In keeping with NetBSD’s policy of supporting only the latest (8.x) and next most recent (7.x) major branches, the recent release of NetBSD 8.0 marks the end of life for NetBSD 6.x. As in the past, a month of overlapping support has been provided in order to ease the migration to newer releases.    As of now, the following branches are no longer maintained:   netbsd-6-1   netbsd-6-0   netbsd-6   This means:   There will be no more pullups to those branches (even for security issues)   There will be no security advisories made for any those branches   The existing 6.x releases on ftp.NetBSD.org will be moved into /pub/NetBSD-archive/   May NetBSD 8.0 serve you well! (And if it doesn’t, please submit a PR!)    ##Beastie Bits  Blast from the past: OpenBSD 3.7 CD artwork People are asking about scale of BSD projects. Let’s figure it out… Tuesday, 21 August 18: me, on ed(1), at SemiBUG arm64 gains RETGUARD Call for participation FreeBSD-UPB/bhyvearm64-utils   ##Feedback/Questions  Eric - FreeNAS for Vacation Patrick - Long Live Unix Jason - Jason - Full MP3 Recordings Bostjan - Question about jails and kernel    Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv 

Episode 263: Encrypt That Pool | BSD Now 263

LPI releases BSD Certification, openzfs trip report, Using FreeBSD with ports, LLDB threading support ready, Linux versus Open Source Unix, and more. Headlines Linux Professional Institute Releases BSD Specialist Certification - re BSD Certification Group  Linux Professional Institute extends its Open Technology certification track with the BSD Specialist Certification. Starting October 30, 2019, BSD Specialist exams will be globally available. The certification was developed in collaboration with the BSD Certification Group which merged with Linux Professional Institute in 2018. G. Matthew Rice, the Executive Director of Linux Professional Institute says that "the release of the BSD Specialist certification marks a major milestone for Linux Professional Institute.  With this new credential, we are reaffirming our belief in the value of, and support for, all open source technologies. As much as possible, future credentials and educational programs will include coverage of BSD.”  OpenZFS Trip Report  The seventh annual OpenZFS Developer Summit took place on November 4th and 5th in San Francisco and brought together a healthy mix of familiar faces and new community participants. Several folks from iXsystems took part in the talks, hacking, and socializing at this amazing annual event. The messages of the event can be summed up as Unification, Refinement, and Ecosystem Tooling.  News Roundup Using FreeBSD with Ports (2/2): Tool-assisted updating  Part 1 here: https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/   In the previous post I explained why sometimes building your software from ports may make sense on FreeBSD. I also introduced the reader to the old-fashioned way of using tools to make working with ports a bit more convenient. In this follow-up post we’re going to take a closer look at portmaster and see how it especially makes updating from ports much, much easier. For people coming here without having read the previous article: What I describe here is not what every FreeBSD admin today should consider good practice (any more)! It can still be useful in special cases, but my main intention is to discuss this for building up the foundation for what you actually should do today.  LLDB Threading support now ready for mainline  Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages. In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report. So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.  Linux VS open source UNIX Beastie Bits  Support for Realtek RTL8125 2.5Gb Ethernet controller Computer Files Are Going Extinct FreeBSD kernel hacking Modern BSD Computing for Fun on a VAX! Trying to use a VAX in today's world by Jeff Armstrong MidnightBSD 1.2 Released  Feedback/Questions  Paulo - Zfs snapshots Phillip - GCP A Listener - Old episodes?   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv        Your browser does not support the HTML5 video tag.

<p>LPI releases BSD Certification, openzfs trip report, Using FreeBSD with ports, LLDB threading support ready, Linux versus Open Source Unix, and more.</p> <h2>Headlines</h2> <h3><a href="https://www.lpi.org/articles/linux-professional-institute-releases-bsd-specialist-certification" rel="nofollow" target="_blank">Linux Professional Institute Releases BSD Specialist Certification - re BSD Certification Group</a></h3> <blockquote> <p>Linux Professional Institute extends its Open Technology certification track with the BSD Specialist Certification. Starting October 30, 2019, BSD Specialist exams will be globally available. The certification was developed in collaboration with the BSD Certification Group which merged with Linux Professional Institute in 2018.</p> <p>G. Matthew Rice, the Executive Director of Linux Professional Institute says that "the release of the BSD Specialist certification marks a major milestone for Linux Professional Institute.  With this new credential, we are reaffirming our belief in the value of, and support for, all open source technologies. As much as possible, future credentials and educational programs will include coverage of BSD.”</p> </blockquote> <h3><a href="https://www.ixsystems.com/blog/openzfs-dev-summit-2019/" rel="nofollow" target="_blank">OpenZFS Trip Report</a></h3> <blockquote> <p>The seventh annual OpenZFS Developer Summit took place on November 4th and 5th in San Francisco and brought together a healthy mix of familiar faces and new community participants. Several folks from iXsystems took part in the talks, hacking, and socializing at this amazing annual event. The messages of the event can be summed up as Unification, Refinement, and Ecosystem Tooling.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://eerielinux.wordpress.com/2019/09/12/using-freebsd-with-ports-2-2-tool-assisted-updating/" rel="nofollow" target="_blank">Using FreeBSD with Ports (2/2): Tool-assisted updating</a></h3> <ul> <li>Part 1 here: <a href="https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/" rel="nofollow" target="_blank">https://eerielinux.wordpress.com/2019/08/18/using-freebsd-with-ports-1-2-classic-way-with-tools/</a></li> </ul> <blockquote> <p>In the previous post I explained why sometimes building your software from ports may make sense on FreeBSD. I also introduced the reader to the old-fashioned way of using tools to make working with ports a bit more convenient.</p> <p>In this follow-up post we’re going to take a closer look at portmaster and see how it especially makes updating from ports much, much easier. For people coming here without having read the previous article: What I describe here is not what every FreeBSD admin today should consider good practice (any more)! It can still be useful in special cases, but my main intention is to discuss this for building up the foundation for what you actually should do today.</p> </blockquote> <h3><a href="http://blog.netbsd.org/tnf/entry/lldb_threading_support_now_ready" rel="nofollow" target="_blank">LLDB Threading support now ready for mainline</a></h3> <blockquote> <p>Upstream describes LLDB as a next generation, high-performance debugger. It is built on top of LLVM/Clang toolchain, and features great integration with it. At the moment, it primarily supports debugging C, C++ and ObjC code, and there is interest in extending it to more languages.</p> <p>In February, I have started working on LLDB, as contracted by the NetBSD Foundation. So far I've been working on reenabling continuous integration, squashing bugs, improving NetBSD core file support, extending NetBSD's ptrace interface to cover more register types and fix compat32 issues and fixing watchpoint support. Then, I've started working on improving thread support which is taking longer than expected. You can read more about that in my September 2019 report.</p> <p>So far the number of issues uncovered while enabling proper threading support has stopped me from merging the work-in-progress patches. However, I've finally reached the point where I believe that the current work can be merged and the remaining problems can be resolved afterwards. More on that and other LLVM-related events happening during the last month in this report.</p> </blockquote> <h3><a href="https://www.adminbyaccident.com/politics/linux-vs-open-source-unix/" rel="nofollow" target="_blank">Linux VS open source UNIX</a></h3> <h2>Beastie Bits</h2> <ul> <li><a href="https://marc.info/?l=openbsd-tech&amp;m=157380442230074&amp;w=2" rel="nofollow" target="_blank">Support for Realtek RTL8125 2.5Gb Ethernet controller</a></li> <li><a href="https://onezero.medium.com/the-death-of-the-computer-file-doc-43cb028c0506" rel="nofollow" target="_blank">Computer Files Are Going Extinct</a></li> <li><a href="https://www.youtube.com/watch?v=4FUub_UtF3c" rel="nofollow" target="_blank">FreeBSD kernel hacking</a></li> <li><a href="https://youtu.be/e7cJ7v2lYdE" rel="nofollow" target="_blank">Modern BSD Computing for Fun on a VAX! Trying to use a VAX in today's world by Jeff Armstrong</a></li> <li><a href="https://www.justjournal.com/users/mbsd/entry/33779" rel="nofollow" target="_blank">MidnightBSD 1.2 Released</a></li> </ul> <h2>Feedback/Questions</h2> <ul> <li>Paulo - <a href="http://dpaste.com/0WQRP43#wrap" rel="nofollow" target="_blank">Zfs snapshots</a></li> <li>Phillip - <a href="http://dpaste.com/075ZQE1#wrap" rel="nofollow" target="_blank">GCP</a></li> <li>A Listener - <a href="http://dpaste.com/3YJ4119#wrap" rel="nofollow" target="_blank">Old episodes?</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li></ul>    <br>    Your browser does not support the HTML5 video tag.

326: Certified BSD

Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more. Headlines Text processing in the shell  This article is part of a self-published book project by Balthazar Rouberol and Etienne Brodu, ex-roommates, friends and colleagues, aiming at empowering the up and coming generation of developers. We currently are hard at work on it! One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc. When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.  Rebalancing data on ZFS mirrors  One of the questions that comes up time and time again about ZFS is “how can I migrate my data to a pool on a few of my disks, then add the rest of the disks afterward?” If you just want to get the data moved and don’t care about balance, you can just copy the data over, then add the new disks and be done with it. But, it won’t be distributed evenly over the vdevs in your pool. Don’t fret, though, it’s actually pretty easy to rebalance mirrors. In the following example, we’ll assume you’ve got four disks in a RAID array on an old machine, and two disks available to copy the data to in the short term.  News Roundup Using OpenBSD relayd to Add Security Headers  I am a huge fan of OpenBSD’s built-in httpd server as it is simple, secure, and quite performant. With the modern push of the large search providers pushing secure websites, it is now important to add security headers to your website or risk having the search results for your website downgraded. Fortunately, it is very easy to do this when you combine httpd with relayd. While relayd is principally designed for layer 3 redirections and layer 7 relays, it just so happens that it makes a handy tool for adding the recommended security headers. My website automatically redirects users from http to https and this gets achieved using a simple redirection in /etc/httpd.conf So if you have a configuration similar to mine, then you will still want to have httpd listen on the egress interface on port 80. The key thing to change here is to have httpd listen on 127.0.0.1 on port 443.  How we set up our ZFS filesystem hierarchy in our ZFS pools  Our long standing practice here, predating even the first generation of our ZFS fileservers, is that we have two main sorts of filesystems, home directories (homedir filesystems) and what we call 'work directory' (workdir) filesystems. Homedir filesystems are called /h/NNN (for some NNN) and workdir filesystems are called /w/NNN; the NNN is unique across all of the different sorts of filesystems. Users are encouraged to put as much stuff as possible in workdirs and can have as many of them as they want, which mattered a lot more in the days when we used Solaris DiskSuite and had fixed-sized filesystems.  Speeding up ZSH https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh  I was opening multiple shells for an unrelated project today and noticed how abysmal my shell load speed was. After the initial load it was relatively fast, but the actual shell start up was noticeably slow. I timed it with time and these were the results. In the future I hope to actually recompile zsh with additional profiling techniques and debug information - keeping an internal timer and having a flag output current time for each command in a tree fashion would make building heat maps really easy.  How do Unix Pipes work  Pipes are cool! We saw how handy they are in a previous blog post. Let’s look at a typical way to use the pipe operator. We have some output, and we want to look at the first lines of the output. Let’s download The Brothers Karamazov by Fyodor Dostoevsky, a fairly long novel.  What we do to enable us to grow our ZFS pools over time  In my entry on why ZFS isn't good at growing and reshaping pools, I mentioned that we go to quite some lengths in our ZFS environment to be able to incrementally expand our pools. Today I want to put together all of the pieces of that in one place to discuss what those lengths are. Our big constraint is that not only do we need to add space to pools over time, but we have a fairly large number of pools and which pools will have space added to them is unpredictable. We need a solution to pool expansion that leaves us with as much flexibility as possible for as long as possible. This pretty much requires being able to expand pools in relatively small increments of space.  Linux maintains bugs: The real reason ifconfig on Linux is deprecated  In my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).  In the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system. Clear Your Terminal in Style  if you’re someone like me who habitually clears their terminal, sometimes you want a little excitement in your life. Here is a way to do just that. This post revolves around the idea of giving a command a percent chance of running. While the topic at hand is not serious, this simple technique has potential in your scripts.  Feedback/Questions  Guy - AMD GPU Help MLShroyer13 - VLANs and Jails Master One - ZFS Suspend/resume   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv               Your browser does not support the HTML5 video tag.

<p>Shell text processing, data rebalancing on ZFS mirrors, Add Security Headers with OpenBSD relayd, ZFS filesystem hierarchy in ZFS pools, speeding up ZSH, How Unix pipes work, grow ZFS pools over time, the real reason ifconfig on Linux is deprecated, clear your terminal in style, and more.</p> <h2>Headlines</h2> <h3><a href="https://blog.balthazar-rouberol.com/text-processing-in-the-shell" rel="nofollow" target="_blank">Text processing in the shell</a></h3> <blockquote> <p>This article is part of a self-published book project by Balthazar Rouberol and Etienne Brodu, ex-roommates, friends and colleagues, aiming at empowering the up and coming generation of developers. We currently are hard at work on it!</p> <p>One of the things that makes the shell an invaluable tool is the amount of available text processing commands, and the ability to easily pipe them into each other to build complex text processing workflows. These commands can make it trivial to perform text and data analysis, convert data between different formats, filter lines, etc.</p> <p>When working with text data, the philosophy is to break any complex problem you have into a set of smaller ones, and to solve each of them with a specialized tool.</p> </blockquote> <h3><a href="https://jrs-s.net/2020/03/10/rebalancing-data-on-zfs-mirrors/" rel="nofollow" target="_blank">Rebalancing data on ZFS mirrors</a></h3> <blockquote> <p>One of the questions that comes up time and time again about ZFS is “how can I migrate my data to a pool on a few of my disks, then add the rest of the disks afterward?”</p> <p>If you just want to get the data moved and don’t care about balance, you can just copy the data over, then add the new disks and be done with it. But, it won’t be distributed evenly over the vdevs in your pool.</p> <p>Don’t fret, though, it’s actually pretty easy to rebalance mirrors. In the following example, we’ll assume you’ve got four disks in a RAID array on an old machine, and two disks available to copy the data to in the short term.</p> </blockquote> <h2>News Roundup</h2> <h3><a href="https://web.archive.org/web/20191109121500/https://goblackcat.com/posts/using-openbsd-relayd-to-add-security-headers/" rel="nofollow" target="_blank">Using OpenBSD relayd to Add Security Headers</a></h3> <blockquote> <p>I am a huge fan of OpenBSD’s built-in httpd server as it is simple, secure, and quite performant. With the modern push of the large search providers pushing secure websites, it is now important to add security headers to your website or risk having the search results for your website downgraded. Fortunately, it is very easy to do this when you combine httpd with relayd. While relayd is principally designed for layer 3 redirections and layer 7 relays, it just so happens that it makes a handy tool for adding the recommended security headers. My website automatically redirects users from http to https and this gets achieved using a simple redirection in /etc/httpd.conf So if you have a configuration similar to mine, then you will still want to have httpd listen on the egress interface on port 80. The key thing to change here is to have httpd listen on 127.0.0.1 on port 443.</p> </blockquote> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSOurContainerFilesystems" rel="nofollow" target="_blank">How we set up our ZFS filesystem hierarchy in our ZFS pools</a></h3> <blockquote> <p>Our long standing practice here, predating even the first generation of our ZFS fileservers, is that we have two main sorts of filesystems, home directories (homedir filesystems) and what we call 'work directory' (workdir) filesystems. Homedir filesystems are called /h/NNN (for some NNN) and workdir filesystems are called /w/NNN; the NNN is unique across all of the different sorts of filesystems. Users are encouraged to put as much stuff as possible in workdirs and can have as many of them as they want, which mattered a lot more in the days when we used Solaris DiskSuite and had fixed-sized filesystems.</p> </blockquote> <h3><a href="https://blog.jonlu.ca/posts/speeding-up-zsh" rel="nofollow" target="_blank">Speeding up ZSH</a></h3> <p><a href="https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh" rel="nofollow" target="_blank">https://web.archive.org/web/20200315184849/https://blog.jonlu.ca/posts/speeding-up-zsh</a></p> <blockquote> <p>I was opening multiple shells for an unrelated project today and noticed how abysmal my shell load speed was. After the initial load it was relatively fast, but the actual shell start up was noticeably slow. I timed it with time and these were the results.</p> <p>In the future I hope to actually recompile zsh with additional profiling techniques and debug information - keeping an internal timer and having a flag output current time for each command in a tree fashion would make building heat maps really easy.</p> </blockquote> <h3><a href="https://www.vegardstikbakke.com/how-do-pipes-work-sigpipe/" rel="nofollow" target="_blank">How do Unix Pipes work</a></h3> <blockquote> <p>Pipes are cool! We saw how handy they are in a previous blog post. Let’s look at a typical way to use the pipe operator. We have some output, and we want to look at the first lines of the output. Let’s download The Brothers Karamazov by Fyodor Dostoevsky, a fairly long novel.</p> </blockquote> <h3><a href="https://utcc.utoronto.ca/%7Ecks/space/blog/solaris/ZFSHowWeGrowPools" rel="nofollow" target="_blank">What we do to enable us to grow our ZFS pools over time</a></h3> <blockquote> <p>In my entry on why ZFS isn't good at growing and reshaping pools, I mentioned that we go to quite some lengths in our ZFS environment to be able to incrementally expand our pools. Today I want to put together all of the pieces of that in one place to discuss what those lengths are.<br/> Our big constraint is that not only do we need to add space to pools over time, but we have a fairly large number of pools and which pools will have space added to them is unpredictable. We need a solution to pool expansion that leaves us with as much flexibility as possible for as long as possible. This pretty much requires being able to expand pools in relatively small increments of space.</p> </blockquote> <h3><a href="https://blog.farhan.codes/2018/06/25/linux-maintains-bugs-the-real-reason-ifconfig-on-linux-is-deprecated/" rel="nofollow" target="_blank">Linux maintains bugs: The real reason ifconfig on Linux is deprecated</a></h3> <blockquote> <p>In my third installment of FreeBSD vs Linux, I will discuss underlying reasons for why Linux moved away from ifconfig(8) to ip(8).</p> </blockquote> <p>In the past, when people said, “Linux is a kernel, not an operating system”, I knew that was true but I always thought it was a rather pedantic criticism. Of course no one runs just the Linux kernel, you run a distribution of Linux. But after reviewing userland code, I understand the significant drawbacks to developing “just a kernel” in isolation from the rest of the system.</p> <h3><a href="https://adammusciano.com/2020/03/04/2020-03-04-clear-your-terminal-in-style/" rel="nofollow" target="_blank">Clear Your Terminal in Style</a></h3> <blockquote> <p>if you’re someone like me who habitually clears their terminal, sometimes you want a little excitement in your life. Here is a way to do just that.</p> <p>This post revolves around the idea of giving a command a percent chance of running. While the topic at hand is not serious, this simple technique has potential in your scripts.</p> </blockquote> <h2>Feedback/Questions</h2> <ul> <li>Guy - <a href="http://dpaste.com/2NEPDHB" rel="nofollow" target="_blank">AMD GPU Help</a></li> <li>MLShroyer13 - <a href="http://dpaste.com/31KBNP4#wrap" rel="nofollow" target="_blank">VLANs and Jails</a></li> <li>Master One - <a href="http://dpaste.com/0DKM8CF#wrap" rel="nofollow" target="_blank">ZFS Suspend/resume</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li> </ul>              Your browser does not support the HTML5 video tag.

344: Grains of Salt

An interview with Trenton Schulz about his early days with FreeBSD, Robot OS, Qt, and more. Interview - Trenton Schulz - freenas@norwegianrockcat.com Robot OS on FreeBSD  BR: Welcome to the show. Can you tell us a little bit about yourself and how you got started with BSD? AJ: You were working for Trolltech (creators of Qt). Was FreeBSD used there and how? BR: Can you tell us more about the work you are doing with Robot OS on FreeBSD? AJ: Was EuroBSDcon your first BSD conference? How did you like it? BR: Do you have some tips or advice on how to get started with the BSDs? AJ: Is there anything else you’d like to tell us before we let you go?  Beastie Bits  FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open Portland BSD Pizza Night: Oct 24th, 19:00 @ Rudy’s Gourmet Pizza NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders  FOSDEM 2020 - BSD Devroom Call for Participation University of Cambridge looking for Research Assistants/Associates   Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv        Your browser does not support the HTML5 video tag.Special Guest: Trenton Shulz.

<p>An interview with Trenton Schulz about his early days with FreeBSD, Robot OS, Qt, and more.</p> <h2>Interview - Trenton Schulz - <a href="mailto:freenas@norwegianrockcat.com" rel="nofollow">freenas@norwegianrockcat.com</a></h2> <p>Robot OS on FreeBSD</p> <ul> <li><strong>BR:</strong> Welcome to the show. Can you tell us a little bit about yourself and how you got started with BSD?</li> <li><strong>AJ:</strong> You were working for Trolltech (creators of Qt). Was FreeBSD used there and how?</li> <li><strong>BR:</strong> Can you tell us more about the work you are doing with Robot OS on FreeBSD?</li> <li><strong>AJ:</strong> Was EuroBSDcon your first BSD conference? How did you like it?</li> <li><strong>BR:</strong> Do you have some tips or advice on how to get started with the BSDs?</li> <li><strong>AJ:</strong> Is there anything else you’d like to tell us before we let you go?</li> </ul> <h2>Beastie Bits</h2> <ul> <li><a href="https://www.freebsdfoundation.org/blog/freebsd-miniconf-at-linux-conf-au-2020-call-for-sessions-now-open/" rel="nofollow" target="_blank">FreeBSD Miniconf at linux.conf.au 2020 Call for Sessions Now Open</a></li> <li><a href="http://calagator.org/events/1250476319" rel="nofollow" target="_blank">Portland BSD Pizza Night: Oct 24th, 19:00 @ Rudy’s Gourmet Pizza</a></li> <li><a href="https://www.nycbug.org/index?action=view&amp;id=10673" rel="nofollow" target="_blank">NYC*BUG Install Fest: Nov 6th 18:45 @ Suspenders </a></li> <li><a href="https://people.freebsd.org/%7Erodrigo/fosdem20/" rel="nofollow" target="_blank">FOSDEM 2020 - BSD Devroom Call for Participation</a></li> <li><a href="https://twitter.com/ed_maste/status/1184865668317007874" rel="nofollow" target="_blank">University of Cambridge looking for Research Assistants/Associates</a></li> </ul> <ul> <li>Send questions, comments, show ideas/topics, or stories you want mentioned on the show to <a href="mailto:feedback@bsdnow.tv" rel="nofollow">feedback@bsdnow.tv</a></li></ul>    <br>    Your browser does not support the HTML5 video tag.<br><p>Special Guest: Trenton Shulz.</p>

321: The Robot OS

The best podcast episodes on Startups. For anyone working in a startup, or anyone interested in the incredible stories behind how people built companies like Instagram, and Facebook. Offering both practical advice and insights, as well as the stories for how many of the biggest startups got to where they are today. Add episodes you're interested into your queue below!

OwlTail

Best Startups Podcasts

The best podcast episodes about true crime. For any thrill seeking podcast listeners who just can't get enough of the captivating stories of murderers and criminals. This topic has all the best episodes from many different true crime podcasts.  Add episodes you're interested into your queue below!